1 /* 2 * Copyright (c) 1997 - 2005 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include "krb5_locl.h" 35 36 RCSID("$Id: creds.c 22062 2007-11-11 15:41:50Z lha $"); 37 38 #undef __attribute__ 39 #define __attribute__(X) 40 41 /* keep this for compatibility with older code */ 42 krb5_error_code KRB5_LIB_FUNCTION __attribute__((deprecated)) 43 krb5_free_creds_contents (krb5_context context, krb5_creds *c) 44 { 45 return krb5_free_cred_contents (context, c); 46 } 47 48 /** 49 * Free content of krb5_creds. 50 * 51 * @param context Kerberos 5 context. 52 * @param c krb5_creds to free. 53 * 54 * @return Returns 0 to indicate success. Otherwise an kerberos et 55 * error code is returned, see krb5_get_error_message(). 56 * 57 * @ingroup krb5 58 */ 59 60 krb5_error_code KRB5_LIB_FUNCTION 61 krb5_free_cred_contents (krb5_context context, krb5_creds *c) 62 { 63 krb5_free_principal (context, c->client); 64 c->client = NULL; 65 krb5_free_principal (context, c->server); 66 c->server = NULL; 67 krb5_free_keyblock_contents (context, &c->session); 68 krb5_data_free (&c->ticket); 69 krb5_data_free (&c->second_ticket); 70 free_AuthorizationData (&c->authdata); 71 krb5_free_addresses (context, &c->addresses); 72 memset(c, 0, sizeof(*c)); 73 return 0; 74 } 75 76 /** 77 * Copy content of krb5_creds. 78 * 79 * @param context Kerberos 5 context. 80 * @param incred source credential 81 * @param c destination credential, free with krb5_free_cred_contents(). 82 * 83 * @return Returns 0 to indicate success. Otherwise an kerberos et 84 * error code is returned, see krb5_get_error_message(). 85 * 86 * @ingroup krb5 87 */ 88 89 krb5_error_code KRB5_LIB_FUNCTION 90 krb5_copy_creds_contents (krb5_context context, 91 const krb5_creds *incred, 92 krb5_creds *c) 93 { 94 krb5_error_code ret; 95 96 memset(c, 0, sizeof(*c)); 97 ret = krb5_copy_principal (context, incred->client, &c->client); 98 if (ret) 99 goto fail; 100 ret = krb5_copy_principal (context, incred->server, &c->server); 101 if (ret) 102 goto fail; 103 ret = krb5_copy_keyblock_contents (context, &incred->session, &c->session); 104 if (ret) 105 goto fail; 106 c->times = incred->times; 107 ret = krb5_data_copy (&c->ticket, 108 incred->ticket.data, 109 incred->ticket.length); 110 if (ret) 111 goto fail; 112 ret = krb5_data_copy (&c->second_ticket, 113 incred->second_ticket.data, 114 incred->second_ticket.length); 115 if (ret) 116 goto fail; 117 ret = copy_AuthorizationData(&incred->authdata, &c->authdata); 118 if (ret) 119 goto fail; 120 ret = krb5_copy_addresses (context, 121 &incred->addresses, 122 &c->addresses); 123 if (ret) 124 goto fail; 125 c->flags = incred->flags; 126 return 0; 127 128 fail: 129 krb5_free_cred_contents (context, c); 130 return ret; 131 } 132 133 /** 134 * Copy krb5_creds. 135 * 136 * @param context Kerberos 5 context. 137 * @param incred source credential 138 * @param outcred destination credential, free with krb5_free_creds(). 139 * 140 * @return Returns 0 to indicate success. Otherwise an kerberos et 141 * error code is returned, see krb5_get_error_message(). 142 * 143 * @ingroup krb5 144 */ 145 146 krb5_error_code KRB5_LIB_FUNCTION 147 krb5_copy_creds (krb5_context context, 148 const krb5_creds *incred, 149 krb5_creds **outcred) 150 { 151 krb5_creds *c; 152 153 c = malloc (sizeof (*c)); 154 if (c == NULL) { 155 krb5_set_error_string (context, "malloc: out of memory"); 156 return ENOMEM; 157 } 158 memset (c, 0, sizeof(*c)); 159 *outcred = c; 160 return krb5_copy_creds_contents (context, incred, c); 161 } 162 163 /** 164 * Free krb5_creds. 165 * 166 * @param context Kerberos 5 context. 167 * @param c krb5_creds to free. 168 * 169 * @return Returns 0 to indicate success. Otherwise an kerberos et 170 * error code is returned, see krb5_get_error_message(). 171 * 172 * @ingroup krb5 173 */ 174 175 krb5_error_code KRB5_LIB_FUNCTION 176 krb5_free_creds (krb5_context context, krb5_creds *c) 177 { 178 krb5_free_cred_contents (context, c); 179 free (c); 180 return 0; 181 } 182 183 /* XXX this do not belong here */ 184 static krb5_boolean 185 krb5_times_equal(const krb5_times *a, const krb5_times *b) 186 { 187 return a->starttime == b->starttime && 188 a->authtime == b->authtime && 189 a->endtime == b->endtime && 190 a->renew_till == b->renew_till; 191 } 192 193 /** 194 * Return TRUE if `mcreds' and `creds' are equal (`whichfields' 195 * determines what equal means). 196 * 197 * @param context Kerberos 5 context. 198 * @param whichfields which fields to compare. 199 * @param mcreds cred to compare with. 200 * @param creds cred to compare with. 201 * 202 * @return return TRUE if mcred and creds are equal, FALSE if not. 203 * 204 * @ingroup krb5 205 */ 206 207 krb5_boolean KRB5_LIB_FUNCTION 208 krb5_compare_creds(krb5_context context, krb5_flags whichfields, 209 const krb5_creds * mcreds, const krb5_creds * creds) 210 { 211 krb5_boolean match = TRUE; 212 213 if (match && mcreds->server) { 214 if (whichfields & (KRB5_TC_DONT_MATCH_REALM | KRB5_TC_MATCH_SRV_NAMEONLY)) 215 match = krb5_principal_compare_any_realm (context, mcreds->server, 216 creds->server); 217 else 218 match = krb5_principal_compare (context, mcreds->server, 219 creds->server); 220 } 221 222 if (match && mcreds->client) { 223 if(whichfields & KRB5_TC_DONT_MATCH_REALM) 224 match = krb5_principal_compare_any_realm (context, mcreds->client, 225 creds->client); 226 else 227 match = krb5_principal_compare (context, mcreds->client, 228 creds->client); 229 } 230 231 if (match && (whichfields & KRB5_TC_MATCH_KEYTYPE)) 232 match = krb5_enctypes_compatible_keys(context, 233 mcreds->session.keytype, 234 creds->session.keytype); 235 236 if (match && (whichfields & KRB5_TC_MATCH_FLAGS_EXACT)) 237 match = mcreds->flags.i == creds->flags.i; 238 239 if (match && (whichfields & KRB5_TC_MATCH_FLAGS)) 240 match = (creds->flags.i & mcreds->flags.i) == mcreds->flags.i; 241 242 if (match && (whichfields & KRB5_TC_MATCH_TIMES_EXACT)) 243 match = krb5_times_equal(&mcreds->times, &creds->times); 244 245 if (match && (whichfields & KRB5_TC_MATCH_TIMES)) 246 /* compare only expiration times */ 247 match = (mcreds->times.renew_till <= creds->times.renew_till) && 248 (mcreds->times.endtime <= creds->times.endtime); 249 250 if (match && (whichfields & KRB5_TC_MATCH_AUTHDATA)) { 251 unsigned int i; 252 if(mcreds->authdata.len != creds->authdata.len) 253 match = FALSE; 254 else 255 for(i = 0; match && i < mcreds->authdata.len; i++) 256 match = (mcreds->authdata.val[i].ad_type == 257 creds->authdata.val[i].ad_type) && 258 (krb5_data_cmp(&mcreds->authdata.val[i].ad_data, 259 &creds->authdata.val[i].ad_data) == 0); 260 } 261 if (match && (whichfields & KRB5_TC_MATCH_2ND_TKT)) 262 match = (krb5_data_cmp(&mcreds->second_ticket, &creds->second_ticket) == 0); 263 264 if (match && (whichfields & KRB5_TC_MATCH_IS_SKEY)) 265 match = ((mcreds->second_ticket.length == 0) == 266 (creds->second_ticket.length == 0)); 267 268 return match; 269 } 270