17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*503a2b89SPeter Shoults * Common Development and Distribution License (the "License"). 6*503a2b89SPeter Shoults * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*503a2b89SPeter Shoults * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate /* 277c478bd9Sstevel@tonic-gate * glue routine for gss_inquire_cred 287c478bd9Sstevel@tonic-gate */ 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate #include <mechglueP.h> 317c478bd9Sstevel@tonic-gate #include <stdio.h> 327c478bd9Sstevel@tonic-gate #include <stdlib.h> 337c478bd9Sstevel@tonic-gate #include <string.h> 347c478bd9Sstevel@tonic-gate #include <time.h> 357c478bd9Sstevel@tonic-gate 367c478bd9Sstevel@tonic-gate OM_uint32 377c478bd9Sstevel@tonic-gate gss_inquire_cred(minor_status, 387c478bd9Sstevel@tonic-gate cred_handle, 397c478bd9Sstevel@tonic-gate name, 407c478bd9Sstevel@tonic-gate lifetime, 417c478bd9Sstevel@tonic-gate cred_usage, 427c478bd9Sstevel@tonic-gate mechanisms) 437c478bd9Sstevel@tonic-gate 447c478bd9Sstevel@tonic-gate OM_uint32 *minor_status; 457c478bd9Sstevel@tonic-gate const gss_cred_id_t cred_handle; 467c478bd9Sstevel@tonic-gate gss_name_t *name; 477c478bd9Sstevel@tonic-gate OM_uint32 *lifetime; 487c478bd9Sstevel@tonic-gate int *cred_usage; 497c478bd9Sstevel@tonic-gate gss_OID_set *mechanisms; 507c478bd9Sstevel@tonic-gate 517c478bd9Sstevel@tonic-gate { 527c478bd9Sstevel@tonic-gate OM_uint32 status, elapsed_time, temp_minor_status; 537c478bd9Sstevel@tonic-gate gss_union_cred_t union_cred; 547c478bd9Sstevel@tonic-gate gss_mechanism mech; 557c478bd9Sstevel@tonic-gate gss_name_t internal_name; 567c478bd9Sstevel@tonic-gate int i; 577c478bd9Sstevel@tonic-gate 58*503a2b89SPeter Shoults /* Initialize outputs. */ 59*503a2b89SPeter Shoults 60*503a2b89SPeter Shoults if (minor_status != NULL) 617c478bd9Sstevel@tonic-gate *minor_status = 0; 627c478bd9Sstevel@tonic-gate 63*503a2b89SPeter Shoults if (name != NULL) 64*503a2b89SPeter Shoults *name = GSS_C_NO_NAME; 657c478bd9Sstevel@tonic-gate 66*503a2b89SPeter Shoults if (mechanisms != NULL) 67*503a2b89SPeter Shoults *mechanisms = GSS_C_NO_OID_SET; 68*503a2b89SPeter Shoults 69*503a2b89SPeter Shoults /* Validate arguments. */ 70*503a2b89SPeter Shoults if (minor_status == NULL) 71*503a2b89SPeter Shoults return (GSS_S_CALL_INACCESSIBLE_WRITE); 727c478bd9Sstevel@tonic-gate 737c478bd9Sstevel@tonic-gate if (cred_handle == GSS_C_NO_CREDENTIAL) { 747c478bd9Sstevel@tonic-gate /* 757c478bd9Sstevel@tonic-gate * No credential was supplied. This means we can't get a mechanism 767c478bd9Sstevel@tonic-gate * pointer to call the mechanism specific gss_inquire_cred. 777c478bd9Sstevel@tonic-gate * So, call get_mechanism with an arguement of GSS_C_NULL_OID. 787c478bd9Sstevel@tonic-gate * get_mechanism will return the first mechanism in the mech 797c478bd9Sstevel@tonic-gate * array, which becomes the default mechanism. 807c478bd9Sstevel@tonic-gate */ 817c478bd9Sstevel@tonic-gate 827c478bd9Sstevel@tonic-gate if ((mech = __gss_get_mechanism(GSS_C_NULL_OID)) == NULL) 837c478bd9Sstevel@tonic-gate return (GSS_S_DEFECTIVE_CREDENTIAL); 847c478bd9Sstevel@tonic-gate 857c478bd9Sstevel@tonic-gate if (!mech->gss_inquire_cred) 867c478bd9Sstevel@tonic-gate return (GSS_S_UNAVAILABLE); 877c478bd9Sstevel@tonic-gate 887c478bd9Sstevel@tonic-gate status = mech->gss_inquire_cred(mech->context, minor_status, 897c478bd9Sstevel@tonic-gate GSS_C_NO_CREDENTIAL, 907c478bd9Sstevel@tonic-gate name ? &internal_name : NULL, 917c478bd9Sstevel@tonic-gate lifetime, cred_usage, 927c478bd9Sstevel@tonic-gate mechanisms); 937c478bd9Sstevel@tonic-gate 947c478bd9Sstevel@tonic-gate if (status != GSS_S_COMPLETE) 957c478bd9Sstevel@tonic-gate return (status); 967c478bd9Sstevel@tonic-gate 977c478bd9Sstevel@tonic-gate if (name) { 987c478bd9Sstevel@tonic-gate /* 997c478bd9Sstevel@tonic-gate * Convert internal_name into a union_name equivalent. 1007c478bd9Sstevel@tonic-gate */ 1017c478bd9Sstevel@tonic-gate status = __gss_convert_name_to_union_name( 1027c478bd9Sstevel@tonic-gate &temp_minor_status, mech, 1037c478bd9Sstevel@tonic-gate internal_name, name); 1047c478bd9Sstevel@tonic-gate if (status != GSS_S_COMPLETE) { 1057c478bd9Sstevel@tonic-gate *minor_status = temp_minor_status; 1067c478bd9Sstevel@tonic-gate if (mechanisms && *mechanisms) { 1077c478bd9Sstevel@tonic-gate (void) gss_release_oid_set( 1087c478bd9Sstevel@tonic-gate &temp_minor_status, 1097c478bd9Sstevel@tonic-gate mechanisms); 1107c478bd9Sstevel@tonic-gate } 1117c478bd9Sstevel@tonic-gate return (status); 1127c478bd9Sstevel@tonic-gate } 1137c478bd9Sstevel@tonic-gate } 1147c478bd9Sstevel@tonic-gate return (GSS_S_COMPLETE); 1157c478bd9Sstevel@tonic-gate } 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate /* get the cred_handle cast as a union_credentials structure */ 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate union_cred = (gss_union_cred_t)cred_handle; 1207c478bd9Sstevel@tonic-gate 1217c478bd9Sstevel@tonic-gate /* 1227c478bd9Sstevel@tonic-gate * get the information out of the union_cred structure that was 1237c478bd9Sstevel@tonic-gate * placed there during gss_acquire_cred. 1247c478bd9Sstevel@tonic-gate */ 1257c478bd9Sstevel@tonic-gate 1267c478bd9Sstevel@tonic-gate if (cred_usage != NULL) 1277c478bd9Sstevel@tonic-gate *cred_usage = union_cred->auxinfo.cred_usage; 1287c478bd9Sstevel@tonic-gate 1297c478bd9Sstevel@tonic-gate if (lifetime != NULL) { 1307c478bd9Sstevel@tonic-gate elapsed_time = time(0) - union_cred->auxinfo.creation_time; 1317c478bd9Sstevel@tonic-gate *lifetime = union_cred->auxinfo.time_rec < elapsed_time ? 0 : 1327c478bd9Sstevel@tonic-gate union_cred->auxinfo.time_rec - elapsed_time; 1337c478bd9Sstevel@tonic-gate } 1347c478bd9Sstevel@tonic-gate 1357c478bd9Sstevel@tonic-gate /* 1367c478bd9Sstevel@tonic-gate * if name is non_null, 1377c478bd9Sstevel@tonic-gate * call gss_import_name() followed by gss_canonicalize_name() 1387c478bd9Sstevel@tonic-gate * to get a mechanism specific name passed back to the caller. 1397c478bd9Sstevel@tonic-gate * If this call fails, return failure to our caller. 1407c478bd9Sstevel@tonic-gate * XXX The cred_handle may contain an array of mechanism OID's 1417c478bd9Sstevel@tonic-gate * but we only return the MN for the first mechanism to the caller. 1427c478bd9Sstevel@tonic-gate * In theory, we should modify this to provide an array of MN's 1437c478bd9Sstevel@tonic-gate * one per mechanism back to the caller. 1447c478bd9Sstevel@tonic-gate */ 1457c478bd9Sstevel@tonic-gate 1467c478bd9Sstevel@tonic-gate if (name != NULL) { 1477c478bd9Sstevel@tonic-gate if ((gss_import_name(minor_status, 1487c478bd9Sstevel@tonic-gate &union_cred->auxinfo.name, 1497c478bd9Sstevel@tonic-gate union_cred->auxinfo.name_type, 1507c478bd9Sstevel@tonic-gate name) != GSS_S_COMPLETE) || 1517c478bd9Sstevel@tonic-gate (gss_canonicalize_name(minor_status, *name, 1527c478bd9Sstevel@tonic-gate &union_cred->mechs_array[0], 1537c478bd9Sstevel@tonic-gate NULL) != GSS_S_COMPLETE)) { 1547c478bd9Sstevel@tonic-gate status = GSS_S_DEFECTIVE_CREDENTIAL; 1557c478bd9Sstevel@tonic-gate goto error; 1567c478bd9Sstevel@tonic-gate } 1577c478bd9Sstevel@tonic-gate } 1587c478bd9Sstevel@tonic-gate 1597c478bd9Sstevel@tonic-gate /* 1607c478bd9Sstevel@tonic-gate * copy the mechanism set in union_cred into an OID set and return in 1617c478bd9Sstevel@tonic-gate * the mechanisms parameter. 1627c478bd9Sstevel@tonic-gate */ 1637c478bd9Sstevel@tonic-gate if (mechanisms != NULL) { 1647c478bd9Sstevel@tonic-gate status = GSS_S_FAILURE; 1657c478bd9Sstevel@tonic-gate *mechanisms = (gss_OID_set) malloc(sizeof (gss_OID_set_desc)); 1667c478bd9Sstevel@tonic-gate if (*mechanisms == NULL) 1677c478bd9Sstevel@tonic-gate goto error; 1687c478bd9Sstevel@tonic-gate 1697c478bd9Sstevel@tonic-gate (*mechanisms)->count = 0; 1707c478bd9Sstevel@tonic-gate (*mechanisms)->elements = 1717c478bd9Sstevel@tonic-gate (gss_OID) malloc(sizeof (gss_OID_desc) * 1727c478bd9Sstevel@tonic-gate union_cred->count); 1737c478bd9Sstevel@tonic-gate 1747c478bd9Sstevel@tonic-gate if ((*mechanisms)->elements == NULL) { 1757c478bd9Sstevel@tonic-gate free(*mechanisms); 1767c478bd9Sstevel@tonic-gate *mechanisms = NULL; 1777c478bd9Sstevel@tonic-gate goto error; 1787c478bd9Sstevel@tonic-gate } 1797c478bd9Sstevel@tonic-gate 1807c478bd9Sstevel@tonic-gate for (i = 0; i < union_cred->count; i++) { 1817c478bd9Sstevel@tonic-gate (*mechanisms)->elements[i].elements = (void *) 1827c478bd9Sstevel@tonic-gate malloc(union_cred->mechs_array[i].length); 1837c478bd9Sstevel@tonic-gate if ((*mechanisms)->elements[i].elements == NULL) 1847c478bd9Sstevel@tonic-gate goto error; 1857c478bd9Sstevel@tonic-gate g_OID_copy(&(*mechanisms)->elements[i], 1867c478bd9Sstevel@tonic-gate &union_cred->mechs_array[i]); 1877c478bd9Sstevel@tonic-gate (*mechanisms)->count++; 1887c478bd9Sstevel@tonic-gate } 1897c478bd9Sstevel@tonic-gate } 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate return (GSS_S_COMPLETE); 1927c478bd9Sstevel@tonic-gate 1937c478bd9Sstevel@tonic-gate error: 1947c478bd9Sstevel@tonic-gate /* 1957c478bd9Sstevel@tonic-gate * cleanup any allocated memory - we can just call 1967c478bd9Sstevel@tonic-gate * gss_release_oid_set, because the set is constructed so that 1977c478bd9Sstevel@tonic-gate * count always references the currently copied number of 1987c478bd9Sstevel@tonic-gate * elements. 1997c478bd9Sstevel@tonic-gate */ 2007c478bd9Sstevel@tonic-gate if (mechanisms && *mechanisms != NULL) 2017c478bd9Sstevel@tonic-gate (void) gss_release_oid_set(&temp_minor_status, mechanisms); 2027c478bd9Sstevel@tonic-gate 2037c478bd9Sstevel@tonic-gate if (name && *name != NULL) 2047c478bd9Sstevel@tonic-gate (void) gss_release_name(&temp_minor_status, name); 2057c478bd9Sstevel@tonic-gate 2067c478bd9Sstevel@tonic-gate return (status); 2077c478bd9Sstevel@tonic-gate } 2087c478bd9Sstevel@tonic-gate 2097c478bd9Sstevel@tonic-gate OM_uint32 2107c478bd9Sstevel@tonic-gate gss_inquire_cred_by_mech(minor_status, cred_handle, mech_type, name, 2117c478bd9Sstevel@tonic-gate initiator_lifetime, acceptor_lifetime, cred_usage) 2127c478bd9Sstevel@tonic-gate OM_uint32 *minor_status; 2137c478bd9Sstevel@tonic-gate const gss_cred_id_t cred_handle; 2147c478bd9Sstevel@tonic-gate const gss_OID mech_type; 2157c478bd9Sstevel@tonic-gate gss_name_t *name; 2167c478bd9Sstevel@tonic-gate OM_uint32 *initiator_lifetime; 2177c478bd9Sstevel@tonic-gate OM_uint32 *acceptor_lifetime; 2187c478bd9Sstevel@tonic-gate gss_cred_usage_t *cred_usage; 2197c478bd9Sstevel@tonic-gate { 2207c478bd9Sstevel@tonic-gate gss_union_cred_t union_cred; 2217c478bd9Sstevel@tonic-gate gss_cred_id_t mech_cred; 2227c478bd9Sstevel@tonic-gate gss_mechanism mech; 2237c478bd9Sstevel@tonic-gate OM_uint32 status, temp_minor_status; 2247c478bd9Sstevel@tonic-gate gss_name_t internal_name; 2257c478bd9Sstevel@tonic-gate 226*503a2b89SPeter Shoults if (minor_status != NULL) 227*503a2b89SPeter Shoults *minor_status = 0; 228*503a2b89SPeter Shoults 229*503a2b89SPeter Shoults if (name != NULL) 230*503a2b89SPeter Shoults *name = GSS_C_NO_NAME; 231*503a2b89SPeter Shoults 232*503a2b89SPeter Shoults if (minor_status == NULL) 233*503a2b89SPeter Shoults return (GSS_S_CALL_INACCESSIBLE_WRITE); 2347c478bd9Sstevel@tonic-gate 2357c478bd9Sstevel@tonic-gate mech = __gss_get_mechanism(mech_type); 2367c478bd9Sstevel@tonic-gate if (!mech) 2377c478bd9Sstevel@tonic-gate return (GSS_S_BAD_MECH); 2387c478bd9Sstevel@tonic-gate if (!mech->gss_inquire_cred_by_mech) 2397c478bd9Sstevel@tonic-gate return (GSS_S_UNAVAILABLE); 2407c478bd9Sstevel@tonic-gate 2417c478bd9Sstevel@tonic-gate union_cred = (gss_union_cred_t)cred_handle; 2427c478bd9Sstevel@tonic-gate mech_cred = __gss_get_mechanism_cred(union_cred, mech_type); 2437c478bd9Sstevel@tonic-gate if (mech_cred == NULL) 2447c478bd9Sstevel@tonic-gate return (GSS_S_DEFECTIVE_CREDENTIAL); 2457c478bd9Sstevel@tonic-gate 246354d1447Swyllys if (mech->gss_inquire_cred_by_mech != NULL) { 247354d1447Swyllys status = mech->gss_inquire_cred_by_mech(mech->context, 248354d1447Swyllys minor_status, 2497c478bd9Sstevel@tonic-gate mech_cred, mech_type, 2507c478bd9Sstevel@tonic-gate name ? &internal_name : NULL, 2517c478bd9Sstevel@tonic-gate initiator_lifetime, 2527c478bd9Sstevel@tonic-gate acceptor_lifetime, cred_usage); 2537c478bd9Sstevel@tonic-gate 2547c478bd9Sstevel@tonic-gate if (status != GSS_S_COMPLETE) 2557c478bd9Sstevel@tonic-gate return (status); 2567c478bd9Sstevel@tonic-gate 2577c478bd9Sstevel@tonic-gate if (name) { 2587c478bd9Sstevel@tonic-gate /* 2597c478bd9Sstevel@tonic-gate * Convert internal_name into a union_name equivalent. 2607c478bd9Sstevel@tonic-gate */ 2617c478bd9Sstevel@tonic-gate status = __gss_convert_name_to_union_name( 2627c478bd9Sstevel@tonic-gate &temp_minor_status, mech, 2637c478bd9Sstevel@tonic-gate internal_name, name); 2647c478bd9Sstevel@tonic-gate if (status != GSS_S_COMPLETE) { 2657c478bd9Sstevel@tonic-gate *minor_status = temp_minor_status; 2667c478bd9Sstevel@tonic-gate return (status); 2677c478bd9Sstevel@tonic-gate } 2687c478bd9Sstevel@tonic-gate } 269354d1447Swyllys } else { 270354d1447Swyllys return (GSS_S_UNAVAILABLE); 271354d1447Swyllys } 2727c478bd9Sstevel@tonic-gate 2737c478bd9Sstevel@tonic-gate return (GSS_S_COMPLETE); 2747c478bd9Sstevel@tonic-gate } 275