1 /*
2 * Copyright (c) 2011, PADL Software Pty Ltd.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 *
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * 3. Neither the name of PADL Software nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY PADL SOFTWARE AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL PADL SOFTWARE OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 #include "mech_locl.h"
34
35 gss_buffer_desc GSSAPI_LIB_VARIABLE __gss_c_attr_local_login_user = {
36 sizeof("local-login-user") - 1,
37 "local-login-user"
38 };
39
40 static OM_uint32
mech_authorize_localname(OM_uint32 * minor_status,const struct _gss_name * name,const struct _gss_name * user)41 mech_authorize_localname(OM_uint32 *minor_status,
42 const struct _gss_name *name,
43 const struct _gss_name *user)
44 {
45 OM_uint32 major_status = GSS_S_NAME_NOT_MN;
46 struct _gss_mechanism_name *mn;
47
48 HEIM_SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
49 gssapi_mech_interface m = mn->gmn_mech;
50
51 if (m->gm_authorize_localname == NULL) {
52 major_status = GSS_S_UNAVAILABLE;
53 continue;
54 }
55
56 major_status = m->gm_authorize_localname(minor_status,
57 mn->gmn_name,
58 &user->gn_value,
59 &user->gn_type);
60 if (major_status != GSS_S_UNAUTHORIZED)
61 break;
62 }
63
64 return major_status;
65 }
66
67 /*
68 * Naming extensions based local login authorization.
69 */
70 static OM_uint32
attr_authorize_localname(OM_uint32 * minor_status,const struct _gss_name * name,const struct _gss_name * user)71 attr_authorize_localname(OM_uint32 *minor_status,
72 const struct _gss_name *name,
73 const struct _gss_name *user)
74 {
75 OM_uint32 major_status = GSS_S_UNAVAILABLE;
76 int more = -1;
77
78 if (!gss_oid_equal(&user->gn_type, GSS_C_NT_USER_NAME))
79 return GSS_S_BAD_NAMETYPE;
80
81 while (more != 0 && major_status != GSS_S_COMPLETE) {
82 OM_uint32 tmpMajor, tmpMinor;
83 gss_buffer_desc value;
84 gss_buffer_desc display_value;
85 int authenticated = 0, complete = 0;
86
87 tmpMajor = gss_get_name_attribute(minor_status,
88 (gss_name_t)name,
89 GSS_C_ATTR_LOCAL_LOGIN_USER,
90 &authenticated,
91 &complete,
92 &value,
93 &display_value,
94 &more);
95 if (GSS_ERROR(tmpMajor)) {
96 major_status = tmpMajor;
97 break;
98 }
99
100 /* If attribute is present, return an authoritative error code. */
101 if (authenticated &&
102 value.length == user->gn_value.length &&
103 memcmp(value.value, user->gn_value.value, user->gn_value.length) == 0)
104 major_status = GSS_S_COMPLETE;
105 else
106 major_status = GSS_S_UNAUTHORIZED;
107
108 gss_release_buffer(&tmpMinor, &value);
109 gss_release_buffer(&tmpMinor, &display_value);
110 }
111
112 return major_status;
113 }
114
115 GSSAPI_LIB_FUNCTION OM_uint32 GSSAPI_LIB_CALL
gss_authorize_localname(OM_uint32 * minor_status,const gss_name_t gss_name,const gss_name_t gss_user)116 gss_authorize_localname(OM_uint32 *minor_status,
117 const gss_name_t gss_name,
118 const gss_name_t gss_user)
119
120 {
121 OM_uint32 major_status;
122 const struct _gss_name *name = (const struct _gss_name *) gss_name;
123 const struct _gss_name *user = (const struct _gss_name *) gss_user;
124 int mechAvailable = 0;
125
126 *minor_status = 0;
127
128 if (gss_name == GSS_C_NO_NAME || gss_user == GSS_C_NO_NAME)
129 return GSS_S_CALL_INACCESSIBLE_READ;
130
131 /*
132 * We should check that the user name is not a mechanism name, but
133 * as Heimdal always calls the mechanism's gss_import_name(), it's
134 * not possible to make this check.
135 */
136 #if 0
137 if (HEIM_SLIST_FIRST(&user->gn_mn) != NULL)
138 return GSS_S_BAD_NAME;
139 #endif
140
141 /* If mech returns yes, we return yes */
142 major_status = mech_authorize_localname(minor_status, name, user);
143 if (major_status == GSS_S_COMPLETE)
144 return GSS_S_COMPLETE;
145 else if (major_status != GSS_S_UNAVAILABLE)
146 mechAvailable = 1;
147
148 /* If attribute exists, it is authoritative */
149 major_status = attr_authorize_localname(minor_status, name, user);
150 if (major_status == GSS_S_COMPLETE || major_status == GSS_S_UNAUTHORIZED)
151 return major_status;
152
153 /* If mechanism did not implement SPI, compare the local name */
154 if (mechAvailable == 0) {
155 int match = 0;
156
157 major_status = gss_compare_name(minor_status, gss_name,
158 gss_user, &match);
159 if (major_status == GSS_S_COMPLETE && match == 0)
160 major_status = GSS_S_UNAUTHORIZED;
161 }
162
163 return major_status;
164 }
165
166 GSSAPI_LIB_FUNCTION int GSSAPI_LIB_CALL
gss_userok(const gss_name_t name,const char * user)167 gss_userok(const gss_name_t name,
168 const char *user)
169 {
170 OM_uint32 major_status, minor_status;
171 gss_buffer_desc userBuf;
172 gss_name_t userName;
173
174 userBuf.value = (void *)user;
175 userBuf.length = strlen(user);
176
177 major_status = gss_import_name(&minor_status, &userBuf,
178 GSS_C_NT_USER_NAME, &userName);
179 if (GSS_ERROR(major_status))
180 return 0;
181
182 major_status = gss_authorize_localname(&minor_status, name, userName);
183
184 gss_release_name(&minor_status, &userName);
185
186 return (major_status == GSS_S_COMPLETE);
187 }
188