1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /*
3 * Copyright 1997, 2007 by Massachusetts Institute of Technology
4 * All Rights Reserved.
5 *
6 * Export of this software from the United States of America may
7 * require a specific license from the United States Government.
8 * It is the responsibility of any person or organization contemplating
9 * export to obtain such a license before exporting.
10 *
11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
12 * distribute this software and its documentation for any purpose and
13 * without fee is hereby granted, provided that the above copyright
14 * notice appear in all copies and that both that copyright notice and
15 * this permission notice appear in supporting documentation, and that
16 * the name of M.I.T. not be used in advertising or publicity pertaining
17 * to distribution of the software without specific, written prior
18 * permission. Furthermore if you modify this software you must label
19 * your software as modified software and not distribute it in such a
20 * fashion that it might be confused with the original M.I.T. software.
21 * M.I.T. makes no representations about the suitability of
22 * this software for any purpose. It is provided "as is" without express
23 * or implied warranty.
24 */
25
26 #include "gssapiP_krb5.h"
27
28 /* Check to see whether or not a GSSAPI krb5 credential is valid. If
29 * it is not, return an error. */
30
31 OM_uint32
krb5_gss_validate_cred_1(OM_uint32 * minor_status,gss_cred_id_t cred_handle,krb5_context context)32 krb5_gss_validate_cred_1(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
33 krb5_context context)
34 {
35 krb5_gss_cred_id_t cred;
36 krb5_error_code code;
37 krb5_principal princ;
38 krb5_boolean same;
39
40 cred = (krb5_gss_cred_id_t) cred_handle;
41 k5_mutex_lock(&cred->lock);
42
43 if (cred->ccache && cred->expire != 0) {
44 if ((code = krb5_cc_get_principal(context, cred->ccache, &princ))) {
45 k5_mutex_unlock(&cred->lock);
46 *minor_status = code;
47 return(GSS_S_DEFECTIVE_CREDENTIAL);
48 }
49 same = krb5_principal_compare(context, princ, cred->name->princ);
50 (void)krb5_free_principal(context, princ);
51 if (!same) {
52 k5_mutex_unlock(&cred->lock);
53 *minor_status = KG_CCACHE_NOMATCH;
54 return(GSS_S_DEFECTIVE_CREDENTIAL);
55 }
56 }
57 *minor_status = 0;
58 return GSS_S_COMPLETE;
59 }
60
61 OM_uint32
krb5_gss_validate_cred(OM_uint32 * minor_status,gss_cred_id_t cred_handle)62 krb5_gss_validate_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle)
63 {
64 krb5_context context;
65 krb5_error_code code;
66 OM_uint32 maj;
67
68 code = krb5_gss_init_context(&context);
69 if (code) {
70 *minor_status = code;
71 return GSS_S_FAILURE;
72 }
73
74 maj = krb5_gss_validate_cred_1(minor_status, cred_handle, context);
75 if (maj == 0) {
76 krb5_gss_cred_id_t cred = (krb5_gss_cred_id_t) cred_handle;
77 k5_mutex_assert_locked(&cred->lock);
78 k5_mutex_unlock(&cred->lock);
79 }
80 save_error_info(*minor_status, context);
81 krb5_free_context(context);
82 return maj;
83 }
84