1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #pragma ident "%Z%%M% %I% %E% SMI" 28 29 #include <k5-int.h> 30 #include <gssapiP_krb5.h> 31 #include <memory.h> 32 #include <assert.h> 33 #include <syslog.h> 34 35 extern uint_t kwarn_add_warning(char *, int); 36 extern uint_t kwarn_del_warning(char *); 37 38 static 39 OM_uint32 40 store_init_cred(ct, minor_status, cred, dflt) 41 krb5_context ct; 42 OM_uint32 *minor_status; 43 const krb5_gss_cred_id_t cred; 44 int dflt; 45 { 46 OM_uint32 maj = GSS_S_COMPLETE; 47 krb5_error_code code; 48 krb5_ccache ccache = NULL; /* current [file] ccache */ 49 krb5_principal ccprinc = NULL; /* default princ of current ccache */ 50 51 if (minor_status == NULL) 52 return (GSS_S_CALL_INACCESSIBLE_WRITE); 53 *minor_status = 0; 54 55 /* Get current ccache -- respect KRB5CCNAME, or use OS default */ 56 if ((code = krb5_cc_default(ct, &ccache))) { 57 *minor_status = code; 58 return (GSS_S_FAILURE); 59 } 60 61 /* 62 * Here we should do something like: 63 * 64 * a) take all the initial tickets from the current ccache for 65 * client principals other than the given cred's 66 * b) copy them to a tmp MEMORY ccache 67 * c) copy the given cred's tickets to that same tmp ccache 68 * d) initialize the current ccache with either the same default 69 * princ as before (!dflt) or with the input cred's princ as the 70 * default princ (dflt) and copy the tmp ccache's creds to it. 71 * 72 * However, for now we just initialize the current ccache, if 73 * (dflt), and copy the input cred's tickets to it. 74 * 75 * To support the above ideal we'd need a variant of 76 * krb5_cc_copy_creds(). But then, preserving any tickets from 77 * the current ccache may be problematic if the ccache has many, 78 * many service tickets in it as that makes ccache enumeration 79 * really, really slow; we might want to address ccache perf 80 * first. 81 * 82 * So storing of non-default credentials is not supported. 83 */ 84 if (dflt) { 85 /* Treat this as "caller asks to initialize ccache" */ 86 /* LINTED */ 87 if ((code = krb5_cc_initialize(ct, ccache, cred->princ))) { 88 *minor_status = code; 89 maj = GSS_S_FAILURE; 90 goto cleanup; 91 } 92 } else { 93 *minor_status = (OM_uint32) G_STORE_NON_DEFAULT_CRED_NOSUPP; 94 maj = GSS_S_FAILURE; 95 goto cleanup; 96 } 97 98 if ((code = krb5_cc_copy_creds(ct, cred->ccache, ccache))) { 99 *minor_status = code; 100 maj = GSS_S_FAILURE; 101 goto cleanup; 102 } 103 104 cleanup: 105 if (ccprinc != NULL) 106 krb5_free_principal(ct, ccprinc); 107 if (ccache != NULL) 108 /* LINTED */ 109 krb5_cc_close(ct, ccache); 110 111 return (maj); 112 } 113 114 OM_uint32 115 krb5_gss_store_cred(minor_status, input_cred, cred_usage, 116 desired_mech, overwrite_cred, default_cred, elements_stored, 117 cred_usage_stored) 118 OM_uint32 *minor_status; 119 const gss_cred_id_t input_cred; 120 gss_cred_usage_t cred_usage; 121 gss_OID desired_mech; 122 OM_uint32 overwrite_cred; 123 OM_uint32 default_cred; 124 gss_OID_set *elements_stored; 125 gss_cred_usage_t *cred_usage_stored; 126 { 127 OM_uint32 maj, maj2, min; 128 krb5_context ctx = NULL; 129 krb5_gss_cred_id_t cred = (krb5_gss_cred_id_t)input_cred; 130 krb5_gss_cred_id_t cur_cred = (krb5_gss_cred_id_t)GSS_C_NO_CREDENTIAL; 131 gss_OID_set desired_mechs = GSS_C_NULL_OID_SET; 132 OM_uint32 in_time_rec; /* lifetime of input cred */ 133 OM_uint32 cur_time_rec; /* lifetime of current cred */ 134 gss_cred_usage_t in_usage; /* usage of input cred */ 135 gss_name_t in_name = GSS_C_NO_NAME; /* name of input cred */ 136 char *client_name = NULL; 137 138 if (input_cred == GSS_C_NO_CREDENTIAL) 139 return (GSS_S_CALL_INACCESSIBLE_READ); 140 141 /* Initialize output parameters */ 142 if (minor_status == NULL) 143 return (GSS_S_CALL_INACCESSIBLE_WRITE); 144 *minor_status = 0; 145 146 if (elements_stored != NULL) 147 *elements_stored = GSS_C_NULL_OID_SET; 148 149 if (cred_usage_stored != NULL) 150 *cred_usage_stored = -1; /* need GSS_C_NEITHER! */ 151 152 /* Sanity check cred_usage */ 153 if (cred_usage != GSS_C_BOTH && cred_usage != GSS_C_INITIATE && 154 cred_usage != GSS_C_ACCEPT) { 155 *minor_status = (OM_uint32) G_BAD_USAGE; 156 return (GSS_S_CALL_BAD_STRUCTURE); 157 } 158 159 /* Not supported: storing acceptor creds -- short cut now */ 160 if (cred_usage == GSS_C_ACCEPT) { 161 *minor_status = (OM_uint32) G_STORE_ACCEPTOR_CRED_NOSUPP; 162 return (GSS_S_FAILURE); 163 } 164 if (cred_usage == GSS_C_BOTH) 165 cred_usage = GSS_C_INITIATE; 166 167 min = krb5_gss_init_context(&ctx); 168 if (min) { 169 *minor_status = min; 170 return (GSS_S_FAILURE); 171 } 172 173 /* * Find out the name, lifetime and cred usage of the input cred */ 174 maj = krb5_gss_inquire_cred(minor_status, input_cred, 175 &in_name, &in_time_rec, &in_usage, NULL); 176 if (GSS_ERROR(maj)) 177 goto cleanup; 178 179 /* Check that the input cred isn't expired */ 180 if (in_time_rec == 0) { 181 maj = GSS_S_CREDENTIALS_EXPIRED; 182 goto cleanup; 183 } 184 185 /* The requested and input cred usage must agree */ 186 if (in_usage != cred_usage && cred_usage != GSS_C_BOTH) { 187 *minor_status = (OM_uint32) G_CRED_USAGE_MISMATCH; 188 maj = GSS_S_NO_CRED; 189 goto cleanup; 190 } 191 192 if (in_usage == GSS_C_ACCEPT) { 193 *minor_status = (OM_uint32) G_STORE_ACCEPTOR_CRED_NOSUPP; 194 maj = GSS_S_FAILURE; 195 goto cleanup; 196 } 197 198 /* Get current cred, if any */ 199 if (desired_mech != GSS_C_NULL_OID) { 200 /* assume that libgss gave us one of our mech OIDs */ 201 maj = gss_create_empty_oid_set(minor_status, &desired_mechs); 202 if (GSS_ERROR(maj)) 203 return (maj); 204 205 maj = gss_add_oid_set_member(minor_status, desired_mech, 206 &desired_mechs); 207 if (GSS_ERROR(maj)) 208 goto cleanup; 209 } 210 211 /* 212 * Handle overwrite_cred option. If overwrite_cred == FALSE 213 * then we must be careful not to overwrite an existing 214 * unexpired credential. 215 */ 216 maj2 = krb5_gss_acquire_cred(&min, 217 (default_cred) ? GSS_C_NO_NAME : in_name, 218 0, desired_mechs, cred_usage, 219 (gss_cred_id_t *)&cur_cred, NULL, &cur_time_rec); 220 221 if (GSS_ERROR(maj2)) 222 overwrite_cred = 1; /* nothing to overwrite */ 223 224 if (cur_time_rec > 0 && !overwrite_cred) { 225 maj = GSS_S_DUPLICATE_ELEMENT; /* would overwrite */ 226 goto cleanup; 227 } 228 229 /* Ready to store -- store_init_cred() handles default_cred */ 230 maj = store_init_cred(ctx, minor_status, cred, default_cred); 231 if (GSS_ERROR(maj)) 232 goto cleanup; 233 234 /* Alert ktkt_warnd(1M) */ 235 maj = krb5_unparse_name(ctx, cred->princ, &client_name); 236 if (GSS_ERROR(maj)) 237 goto cleanup; 238 (void) kwarn_del_warning(client_name); 239 if (kwarn_add_warning(client_name, cred->tgt_expire) != 0) { 240 syslog(LOG_AUTH|LOG_NOTICE, 241 "store_cred: kwarn_add_warning" 242 " failed: ktkt_warnd(1M) down? "); 243 } 244 free(client_name); 245 client_name = NULL; 246 247 /* Output parameters */ 248 if (cred_usage_stored != NULL) 249 *cred_usage_stored = GSS_C_INITIATE; 250 251 if (elements_stored != NULL) { 252 maj = gss_create_empty_oid_set(minor_status, elements_stored); 253 if (GSS_ERROR(maj)) 254 goto cleanup; 255 256 maj = gss_add_oid_set_member(minor_status, 257 (const gss_OID)gss_mech_krb5, elements_stored); 258 if (GSS_ERROR(maj)) { 259 (void) gss_release_oid_set(&min, elements_stored); 260 *elements_stored = GSS_C_NULL_OID_SET; 261 goto cleanup; 262 } 263 } 264 265 cleanup: 266 if (desired_mechs != GSS_C_NULL_OID_SET) 267 (void) gss_release_oid_set(&min, &desired_mechs); 268 if (cur_cred != (krb5_gss_cred_id_t)GSS_C_NO_CREDENTIAL) 269 (void) krb5_gss_release_cred(&min, 270 (gss_cred_id_t *)&cur_cred); 271 if (in_name != GSS_C_NO_NAME) 272 (void) krb5_gss_release_name(&min, &in_name); 273 274 if (ctx) 275 krb5_free_context(ctx); 276 277 return (maj); 278 } 279