17c478bd9Sstevel@tonic-gate /* 2*5e01956fSGlenn Barry * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved. 37c478bd9Sstevel@tonic-gate */ 47c478bd9Sstevel@tonic-gate /* 57c478bd9Sstevel@tonic-gate * Copyright 1993 by OpenVision Technologies, Inc. 67c478bd9Sstevel@tonic-gate * 77c478bd9Sstevel@tonic-gate * Permission to use, copy, modify, distribute, and sell this software 87c478bd9Sstevel@tonic-gate * and its documentation for any purpose is hereby granted without fee, 97c478bd9Sstevel@tonic-gate * provided that the above copyright notice appears in all copies and 107c478bd9Sstevel@tonic-gate * that both that copyright notice and this permission notice appear in 117c478bd9Sstevel@tonic-gate * supporting documentation, and that the name of OpenVision not be used 127c478bd9Sstevel@tonic-gate * in advertising or publicity pertaining to distribution of the software 137c478bd9Sstevel@tonic-gate * without specific, written prior permission. OpenVision makes no 147c478bd9Sstevel@tonic-gate * representations about the suitability of this software for any 157c478bd9Sstevel@tonic-gate * purpose. It is provided "as is" without express or implied warranty. 167c478bd9Sstevel@tonic-gate * 177c478bd9Sstevel@tonic-gate * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, 187c478bd9Sstevel@tonic-gate * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO 197c478bd9Sstevel@tonic-gate * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR 207c478bd9Sstevel@tonic-gate * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF 217c478bd9Sstevel@tonic-gate * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR 227c478bd9Sstevel@tonic-gate * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 237c478bd9Sstevel@tonic-gate * PERFORMANCE OF THIS SOFTWARE. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 26ab9b2e15Sgtb #include "gssapiP_krb5.h" 27ab9b2e15Sgtb #include "mglueP.h" /* SUNW15resync - for KGSS_ macros */ 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate /* 30159d09a2SMark Phalan * $Id: delete_sec_context.c 18396 2006-07-25 20:29:43Z lxs $ 317c478bd9Sstevel@tonic-gate */ 327c478bd9Sstevel@tonic-gate 33ab9b2e15Sgtb 34ab9b2e15Sgtb #ifdef _KERNEL 35ab9b2e15Sgtb /* SUNW15resync - todo - unify these kernel rel oid funcs with user spc ones */ 36ab9b2e15Sgtb 377c478bd9Sstevel@tonic-gate OM_uint32 38ab9b2e15Sgtb krb5_gss_internal_release_oid(minor_status, oid) 397c478bd9Sstevel@tonic-gate OM_uint32 *minor_status; 40ab9b2e15Sgtb gss_OID *oid; 417c478bd9Sstevel@tonic-gate { 42ab9b2e15Sgtb /* 43ab9b2e15Sgtb * This function only knows how to release internal OIDs. It will 44ab9b2e15Sgtb * return GSS_S_CONTINUE_NEEDED for any OIDs it does not recognize. 45ab9b2e15Sgtb */ 467c478bd9Sstevel@tonic-gate 47ab9b2e15Sgtb if ((*oid != gss_mech_krb5) && 48ab9b2e15Sgtb (*oid != gss_mech_krb5_old) && 49ab9b2e15Sgtb (*oid != gss_mech_krb5_wrong) && 50ab9b2e15Sgtb (*oid != gss_nt_krb5_name) && 51ab9b2e15Sgtb (*oid != gss_nt_krb5_principal)) { 52ab9b2e15Sgtb /* We don't know about this OID */ 53ab9b2e15Sgtb return(GSS_S_CONTINUE_NEEDED); 547c478bd9Sstevel@tonic-gate } 55ab9b2e15Sgtb else { 56ab9b2e15Sgtb *oid = GSS_C_NO_OID; 57ab9b2e15Sgtb *minor_status = 0; 58ab9b2e15Sgtb return(GSS_S_COMPLETE); 59ab9b2e15Sgtb } 60ab9b2e15Sgtb } 61ab9b2e15Sgtb 62ab9b2e15Sgtb OM_uint32 63ab9b2e15Sgtb generic_gss_release_oid(minor_status, oid) 64ab9b2e15Sgtb OM_uint32 *minor_status; 65ab9b2e15Sgtb gss_OID *oid; 66ab9b2e15Sgtb { 67ab9b2e15Sgtb if (minor_status) 68ab9b2e15Sgtb *minor_status = 0; 69ab9b2e15Sgtb 70ab9b2e15Sgtb if (*oid == GSS_C_NO_OID) 71ab9b2e15Sgtb return(GSS_S_COMPLETE); 72ab9b2e15Sgtb 73ab9b2e15Sgtb 74ab9b2e15Sgtb if ((*oid != GSS_C_NT_USER_NAME) && 75ab9b2e15Sgtb (*oid != GSS_C_NT_MACHINE_UID_NAME) && 76ab9b2e15Sgtb (*oid != GSS_C_NT_STRING_UID_NAME) && 77ab9b2e15Sgtb (*oid != GSS_C_NT_HOSTBASED_SERVICE) && 78ab9b2e15Sgtb (*oid != GSS_C_NT_ANONYMOUS) && 79ab9b2e15Sgtb (*oid != GSS_C_NT_EXPORT_NAME) && 80ab9b2e15Sgtb (*oid != gss_nt_service_name)) { 81ab9b2e15Sgtb FREE((*oid)->elements, (*oid)->length); 82ab9b2e15Sgtb FREE(*oid, sizeof(gss_OID_desc)); 83ab9b2e15Sgtb } 84ab9b2e15Sgtb *oid = GSS_C_NO_OID; 85ab9b2e15Sgtb return(GSS_S_COMPLETE); 86ab9b2e15Sgtb } 87ab9b2e15Sgtb 88ab9b2e15Sgtb OM_uint32 89ab9b2e15Sgtb krb5_gss_release_oid(minor_status, oid) 90ab9b2e15Sgtb OM_uint32 *minor_status; 91ab9b2e15Sgtb gss_OID *oid; 92ab9b2e15Sgtb { 93ab9b2e15Sgtb 94ab9b2e15Sgtb if (krb5_gss_internal_release_oid(minor_status, oid) != GSS_S_COMPLETE) { 95ab9b2e15Sgtb /* Pawn it off on the generic routine */ 96ab9b2e15Sgtb return(generic_gss_release_oid(minor_status, oid)); 97ab9b2e15Sgtb } 98ab9b2e15Sgtb else { 99ab9b2e15Sgtb *oid = GSS_C_NO_OID; 100ab9b2e15Sgtb *minor_status = 0; 101ab9b2e15Sgtb return(GSS_S_COMPLETE); 102ab9b2e15Sgtb } 103ab9b2e15Sgtb } 104ab9b2e15Sgtb #endif 1057c478bd9Sstevel@tonic-gate 1067c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 1077c478bd9Sstevel@tonic-gate OM_uint32 108ab9b2e15Sgtb krb5_gss_delete_sec_context(minor_status, 1097c478bd9Sstevel@tonic-gate context_handle, 1107c478bd9Sstevel@tonic-gate output_token 1117c478bd9Sstevel@tonic-gate #ifdef _KERNEL 1127c478bd9Sstevel@tonic-gate , gssd_ctx_verifier 1137c478bd9Sstevel@tonic-gate #endif 1147c478bd9Sstevel@tonic-gate ) 1157c478bd9Sstevel@tonic-gate OM_uint32 *minor_status; 1167c478bd9Sstevel@tonic-gate gss_ctx_id_t *context_handle; 1177c478bd9Sstevel@tonic-gate gss_buffer_t output_token; 1187c478bd9Sstevel@tonic-gate #ifdef _KERNEL 1197c478bd9Sstevel@tonic-gate OM_uint32 gssd_ctx_verifier; 1207c478bd9Sstevel@tonic-gate #endif 1217c478bd9Sstevel@tonic-gate { 122ab9b2e15Sgtb krb5_context context; 1237c478bd9Sstevel@tonic-gate krb5_gss_ctx_id_rec *ctx; 1247c478bd9Sstevel@tonic-gate 1257c478bd9Sstevel@tonic-gate if (output_token) { 1267c478bd9Sstevel@tonic-gate output_token->length = 0; 1277c478bd9Sstevel@tonic-gate output_token->value = NULL; 1287c478bd9Sstevel@tonic-gate } 1297c478bd9Sstevel@tonic-gate 1307c478bd9Sstevel@tonic-gate /*SUPPRESS 29*/ 1317c478bd9Sstevel@tonic-gate if (*context_handle == GSS_C_NO_CONTEXT) { 1327c478bd9Sstevel@tonic-gate *minor_status = 0; 133ab9b2e15Sgtb return(GSS_S_COMPLETE); 1347c478bd9Sstevel@tonic-gate } 1357c478bd9Sstevel@tonic-gate 1367c478bd9Sstevel@tonic-gate /*SUPPRESS 29*/ 1377c478bd9Sstevel@tonic-gate /* validate the context handle */ 1387c478bd9Sstevel@tonic-gate if (! kg_validate_ctx_id(*context_handle)) { 1397c478bd9Sstevel@tonic-gate *minor_status = (OM_uint32) G_VALIDATE_FAILED; 140ab9b2e15Sgtb return(GSS_S_NO_CONTEXT); 1417c478bd9Sstevel@tonic-gate } 1427c478bd9Sstevel@tonic-gate 143ab9b2e15Sgtb ctx = (krb5_gss_ctx_id_t) *context_handle; 144ab9b2e15Sgtb context = ctx->k5_context; 145ab9b2e15Sgtb 1467c478bd9Sstevel@tonic-gate /* construct a delete context token if necessary */ 1477c478bd9Sstevel@tonic-gate 1487c478bd9Sstevel@tonic-gate if (output_token) { 149ab9b2e15Sgtb OM_uint32 major; 1507c478bd9Sstevel@tonic-gate gss_buffer_desc empty; 1517c478bd9Sstevel@tonic-gate empty.length = 0; empty.value = NULL; 1527c478bd9Sstevel@tonic-gate 153ab9b2e15Sgtb if ((major = kg_seal(minor_status, *context_handle, 0, 1547c478bd9Sstevel@tonic-gate GSS_C_QOP_DEFAULT, 155*5e01956fSGlenn Barry &empty, NULL, output_token, KG_TOK_DEL_CTX))) { 156*5e01956fSGlenn Barry save_error_info(*minor_status, context); 157ab9b2e15Sgtb return(major); 1587c478bd9Sstevel@tonic-gate } 159*5e01956fSGlenn Barry } 1607c478bd9Sstevel@tonic-gate 1617c478bd9Sstevel@tonic-gate /* invalidate the context handle */ 1627c478bd9Sstevel@tonic-gate 1637c478bd9Sstevel@tonic-gate (void)kg_delete_ctx_id(*context_handle); 1647c478bd9Sstevel@tonic-gate 1657c478bd9Sstevel@tonic-gate /* free all the context state */ 1667c478bd9Sstevel@tonic-gate 1677c478bd9Sstevel@tonic-gate if (ctx->seqstate) 1687c478bd9Sstevel@tonic-gate g_order_free(&(ctx->seqstate)); 1697c478bd9Sstevel@tonic-gate 1707c478bd9Sstevel@tonic-gate if (ctx->enc) 1717c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, ctx->enc); 1727c478bd9Sstevel@tonic-gate 1737c478bd9Sstevel@tonic-gate if (ctx->seq) 1747c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, ctx->seq); 1757c478bd9Sstevel@tonic-gate 1767c478bd9Sstevel@tonic-gate if (ctx->here) 1777c478bd9Sstevel@tonic-gate krb5_free_principal(context, ctx->here); 1787c478bd9Sstevel@tonic-gate if (ctx->there) 1797c478bd9Sstevel@tonic-gate krb5_free_principal(context, ctx->there); 1807c478bd9Sstevel@tonic-gate if (ctx->subkey) 1817c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, ctx->subkey); 1827c478bd9Sstevel@tonic-gate if (ctx->acceptor_subkey) 1837c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, ctx->acceptor_subkey); 1847c478bd9Sstevel@tonic-gate 1857c478bd9Sstevel@tonic-gate /* We never import the auth_context into the kernel */ 1867c478bd9Sstevel@tonic-gate #ifndef _KERNEL 1877c478bd9Sstevel@tonic-gate if (ctx->auth_context) { 188ab9b2e15Sgtb if (ctx->cred_rcache) 1897c478bd9Sstevel@tonic-gate (void)krb5_auth_con_setrcache(context, ctx->auth_context, NULL); 190ab9b2e15Sgtb 1917c478bd9Sstevel@tonic-gate krb5_auth_con_free(context, ctx->auth_context); 1927c478bd9Sstevel@tonic-gate } 1937c478bd9Sstevel@tonic-gate #endif 1947c478bd9Sstevel@tonic-gate 195ab9b2e15Sgtb if (ctx->mech_used) 196ab9b2e15Sgtb (void) KGSS_RELEASE_OID(minor_status, &ctx->mech_used); 197ab9b2e15Sgtb 198ba7b222eSGlenn Barry if (ctx->authdata) 199ba7b222eSGlenn Barry krb5_free_authdata(context, ctx->authdata); 200ba7b222eSGlenn Barry 201ab9b2e15Sgtb if (ctx->k5_context) 202ab9b2e15Sgtb krb5_free_context(ctx->k5_context); 2037c478bd9Sstevel@tonic-gate 2047c478bd9Sstevel@tonic-gate /* Zero out context */ 2057c478bd9Sstevel@tonic-gate (void) memset(ctx, 0, sizeof(*ctx)); 2067c478bd9Sstevel@tonic-gate xfree_wrap(ctx, sizeof (krb5_gss_ctx_id_rec)); 2077c478bd9Sstevel@tonic-gate 2087c478bd9Sstevel@tonic-gate /* zero the handle itself */ 2097c478bd9Sstevel@tonic-gate 2107c478bd9Sstevel@tonic-gate *context_handle = GSS_C_NO_CONTEXT; 2117c478bd9Sstevel@tonic-gate 2127c478bd9Sstevel@tonic-gate *minor_status = 0; 213ab9b2e15Sgtb return(GSS_S_COMPLETE); 2147c478bd9Sstevel@tonic-gate } 215