1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */ 2 /* 3 * Copyright 2009 by the Massachusetts Institute of Technology. 4 * All Rights Reserved. 5 * 6 * Export of this software from the United States of America may 7 * require a specific license from the United States Government. 8 * It is the responsibility of any person or organization contemplating 9 * export to obtain such a license before exporting. 10 * 11 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 12 * distribute this software and its documentation for any purpose and 13 * without fee is hereby granted, provided that the above copyright 14 * notice appear in all copies and that both that copyright notice and 15 * this permission notice appear in supporting documentation, and that 16 * the name of M.I.T. not be used in advertising or publicity pertaining 17 * to distribution of the software without specific, written prior 18 * permission. Furthermore if you modify this software you must label 19 * your software as modified software and not distribute it in such a 20 * fashion that it might be confused with the original M.I.T. software. 21 * M.I.T. makes no representations about the suitability of 22 * this software for any purpose. It is provided "as is" without express 23 * or implied warranty. 24 */ 25 26 #include <stdio.h> 27 #include <stdlib.h> 28 #include <string.h> 29 30 #include "common.h" 31 32 static int use_spnego = 0; 33 34 static void 35 display_name(const char *tag, gss_name_t name) 36 { 37 OM_uint32 major, minor; 38 gss_buffer_desc buf; 39 40 major = gss_display_name(&minor, name, &buf, NULL); 41 check_gsserr("gss_display_name", major, minor); 42 43 printf("%s:\t%.*s\n", tag, (int)buf.length, (char *)buf.value); 44 45 (void)gss_release_buffer(&minor, &buf); 46 } 47 48 static void 49 test_export_import_name(gss_name_t name) 50 { 51 OM_uint32 major, minor; 52 gss_buffer_desc exported_name = GSS_C_EMPTY_BUFFER; 53 gss_name_t imported_name = GSS_C_NO_NAME; 54 gss_name_t imported_name_comp = GSS_C_NO_NAME; 55 unsigned int i; 56 57 major = gss_export_name_composite(&minor, name, &exported_name); 58 check_gsserr("gss_export_name_composite", major, minor); 59 60 printf("Exported name:\n"); 61 for (i = 0; i < exported_name.length; i++) { 62 if ((i % 32) == 0) 63 printf("\n"); 64 printf("%02x", ((char *)exported_name.value)[i] & 0xFF); 65 } 66 printf("\n"); 67 68 major = gss_import_name(&minor, &exported_name, GSS_C_NT_EXPORT_NAME, 69 &imported_name); 70 check_gsserr("gss_import_name", major, minor); 71 72 major = gss_import_name(&minor, &exported_name, GSS_C_NT_COMPOSITE_EXPORT, 73 &imported_name_comp); 74 check_gsserr("gss_import_name", major, minor); 75 (void)gss_release_buffer(&minor, &exported_name); 76 77 printf("\n"); 78 display_canon_name("Re-imported name", imported_name, &mech_krb5); 79 printf("Re-imported attributes:\n\n"); 80 enumerate_attributes(imported_name, 0); 81 82 display_name("Re-imported (as composite) name", imported_name_comp); 83 printf("Re-imported (as composite) attributes:\n\n"); 84 enumerate_attributes(imported_name_comp, 0); 85 86 (void)gss_release_name(&minor, &imported_name); 87 (void)gss_release_name(&minor, &imported_name_comp); 88 } 89 90 static void 91 test_greet_authz_data(gss_name_t name) 92 { 93 OM_uint32 major, minor; 94 gss_buffer_desc attr; 95 gss_buffer_desc value; 96 97 attr.value = "urn:greet:greeting"; 98 attr.length = strlen((char *)attr.value); 99 100 major = gss_delete_name_attribute(&minor, name, &attr); 101 if (major == GSS_S_UNAVAILABLE) { 102 fprintf(stderr, "Warning: greet_client plugin not installed\n"); 103 exit(1); 104 } 105 check_gsserr("gss_delete_name_attribute", major, minor); 106 107 value.value = "Hello, acceptor world!"; 108 value.length = strlen((char *)value.value); 109 major = gss_set_name_attribute(&minor, name, 1, &attr, &value); 110 if (major == GSS_S_UNAVAILABLE) 111 return; 112 check_gsserr("gss_set_name_attribute", major, minor); 113 } 114 115 static void 116 test_map_name_to_any(gss_name_t name) 117 { 118 OM_uint32 major, minor; 119 gss_buffer_desc type_id; 120 krb5_pac pac; 121 krb5_context context = NULL; 122 krb5_error_code ret; 123 size_t len, i; 124 krb5_ui_4 *types; 125 126 type_id.value = "mspac"; 127 type_id.length = strlen((char *)type_id.value); 128 129 major = gss_map_name_to_any(&minor, name, 1, &type_id, (gss_any_t *)&pac); 130 if (major == GSS_S_UNAVAILABLE) 131 return; 132 check_gsserr("gss_map_name_to_any", major, minor); 133 134 ret = krb5_init_context(&context); 135 check_k5err(context, "krb5_init_context", ret); 136 137 if (krb5_pac_get_types(context, pac, &len, &types) == 0) { 138 printf("PAC buffer types:"); 139 for (i = 0; i < len; i++) 140 printf(" %d", types[i]); 141 printf("\n"); 142 free(types); 143 } 144 145 (void)gss_release_any_name_mapping(&minor, name, &type_id, 146 (gss_any_t *)&pac); 147 } 148 149 static void 150 init_accept_sec_context(gss_cred_id_t verifier_cred_handle) 151 { 152 OM_uint32 major, minor, flags; 153 gss_name_t source_name = GSS_C_NO_NAME, target_name = GSS_C_NO_NAME; 154 gss_ctx_id_t initiator_context, acceptor_context; 155 gss_OID mech = use_spnego ? &mech_spnego : &mech_krb5; 156 157 major = gss_inquire_cred(&minor, verifier_cred_handle, &target_name, NULL, 158 NULL, NULL); 159 check_gsserr("gss_inquire_cred", major, minor); 160 161 display_canon_name("Target name", target_name, &mech_krb5); 162 163 flags = GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG; 164 establish_contexts(mech, verifier_cred_handle, verifier_cred_handle, 165 target_name, flags, &initiator_context, 166 &acceptor_context, &source_name, NULL, NULL); 167 168 display_canon_name("Source name", source_name, &mech_krb5); 169 enumerate_attributes(source_name, 1); 170 test_export_import_name(source_name); 171 test_map_name_to_any(source_name); 172 173 (void)gss_release_name(&minor, &source_name); 174 (void)gss_release_name(&minor, &target_name); 175 (void)gss_delete_sec_context(&minor, &initiator_context, NULL); 176 (void)gss_delete_sec_context(&minor, &acceptor_context, NULL); 177 } 178 179 int 180 main(int argc, char *argv[]) 181 { 182 OM_uint32 minor, major; 183 gss_cred_id_t cred_handle = GSS_C_NO_CREDENTIAL; 184 gss_OID_set mechs, actual_mechs = GSS_C_NO_OID_SET; 185 gss_name_t tmp_name, name; 186 187 if (argc > 1 && strcmp(argv[1], "--spnego") == 0) { 188 use_spnego++; 189 argc--; 190 argv++; 191 } 192 193 if (argc < 2) { 194 fprintf(stderr, "Usage: %s [--spnego] principal [keytab]\n", argv[0]); 195 exit(1); 196 } 197 198 tmp_name = import_name(argv[1]); 199 major = gss_canonicalize_name(&minor, tmp_name, &mech_krb5, &name); 200 check_gsserr("gss_canonicalze_name", major, minor); 201 (void)gss_release_name(&minor, &tmp_name); 202 203 test_greet_authz_data(name); 204 205 if (argc >= 3) { 206 major = krb5_gss_register_acceptor_identity(argv[2]); 207 check_gsserr("krb5_gss_register_acceptor_identity", major, minor); 208 } 209 210 mechs = use_spnego ? &mechset_spnego : &mechset_krb5; 211 212 /* get default cred */ 213 major = gss_acquire_cred(&minor, name, GSS_C_INDEFINITE, mechs, GSS_C_BOTH, 214 &cred_handle, &actual_mechs, NULL); 215 check_gsserr("gss_acquire_cred", major, minor); 216 217 (void)gss_release_oid_set(&minor, &actual_mechs); 218 219 init_accept_sec_context(cred_handle); 220 221 printf("\n"); 222 223 (void)gss_release_cred(&minor, &cred_handle); 224 (void)gss_release_oid_set(&minor, &actual_mechs); 225 (void)gss_release_name(&minor, &name); 226 return 0; 227 } 228