|
Packit Service |
99d1c0 |
/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
|
|
Packit Service |
99d1c0 |
/* plugins/gssapi/negoextest/main.c - GSS test module for NegoEx */
|
|
Packit Service |
99d1c0 |
/*
|
|
Packit Service |
99d1c0 |
* Copyright (C) 2019 by the Massachusetts Institute of Technology.
|
|
Packit Service |
99d1c0 |
* All rights reserved.
|
|
Packit Service |
99d1c0 |
*
|
|
Packit Service |
99d1c0 |
* Redistribution and use in source and binary forms, with or without
|
|
Packit Service |
99d1c0 |
* modification, are permitted provided that the following conditions
|
|
Packit Service |
99d1c0 |
* are met:
|
|
Packit Service |
99d1c0 |
*
|
|
Packit Service |
99d1c0 |
* * Redistributions of source code must retain the above copyright
|
|
Packit Service |
99d1c0 |
* notice, this list of conditions and the following disclaimer.
|
|
Packit Service |
99d1c0 |
*
|
|
Packit Service |
99d1c0 |
* * Redistributions in binary form must reproduce the above copyright
|
|
Packit Service |
99d1c0 |
* notice, this list of conditions and the following disclaimer in
|
|
Packit Service |
99d1c0 |
* the documentation and/or other materials provided with the
|
|
Packit Service |
99d1c0 |
* distribution.
|
|
Packit Service |
99d1c0 |
*
|
|
Packit Service |
99d1c0 |
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
Packit Service |
99d1c0 |
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
Packit Service |
99d1c0 |
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
Packit Service |
99d1c0 |
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
Packit Service |
99d1c0 |
* COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
|
|
Packit Service |
99d1c0 |
* INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
|
|
Packit Service |
99d1c0 |
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
Packit Service |
99d1c0 |
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
Packit Service |
99d1c0 |
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
Packit Service |
99d1c0 |
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
Packit Service |
99d1c0 |
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
Packit Service |
99d1c0 |
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
Packit Service |
99d1c0 |
*/
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
#include "k5-int.h"
|
|
Packit Service |
99d1c0 |
#include <gssapi/gssapi.h>
|
|
Packit Service |
99d1c0 |
#include <gssapi/gssapi_ext.h>
|
|
Packit Service |
99d1c0 |
#include <gssapi/gssapi_alloc.h>
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
struct test_context {
|
|
Packit Service |
99d1c0 |
int initiator;
|
|
Packit Service |
99d1c0 |
uint8_t hops; /* hops remaining; 0 means established */
|
|
Packit Service |
99d1c0 |
};
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_init_sec_context(OM_uint32 *minor_status,
|
|
Packit Service |
99d1c0 |
gss_cred_id_t claimant_cred_handle,
|
|
Packit Service |
99d1c0 |
gss_ctx_id_t *context_handle, gss_name_t target_name,
|
|
Packit Service |
99d1c0 |
gss_OID mech_type, OM_uint32 req_flags,
|
|
Packit Service |
99d1c0 |
OM_uint32 time_req,
|
|
Packit Service |
99d1c0 |
gss_channel_bindings_t input_chan_bindings,
|
|
Packit Service |
99d1c0 |
gss_buffer_t input_token, gss_OID *actual_mech,
|
|
Packit Service |
99d1c0 |
gss_buffer_t output_token, OM_uint32 *ret_flags,
|
|
Packit Service |
99d1c0 |
OM_uint32 *time_rec)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
struct test_context *ctx = (struct test_context *)*context_handle;
|
|
Packit Service |
99d1c0 |
OM_uint32 major;
|
|
Packit Service |
99d1c0 |
gss_buffer_desc tok;
|
|
Packit Service |
99d1c0 |
const char *envstr;
|
|
Packit Service |
99d1c0 |
uint8_t hops, mech_last_octet;
|
|
Packit Service |
99d1c0 |
|
|
rpm-build |
88d58e |
envstr = getenv("GSS_INIT_BINDING");
|
|
rpm-build |
88d58e |
if (envstr != NULL) {
|
|
rpm-build |
88d58e |
assert(strlen(envstr) > 0);
|
|
rpm-build |
88d58e |
assert(input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS);
|
|
rpm-build |
88d58e |
assert(strlen(envstr) == input_chan_bindings->application_data.length);
|
|
rpm-build |
88d58e |
assert(strcmp((char *)input_chan_bindings->application_data.value,
|
|
rpm-build |
88d58e |
envstr) == 0);
|
|
rpm-build |
88d58e |
}
|
|
rpm-build |
88d58e |
|
|
Packit Service |
99d1c0 |
if (input_token == GSS_C_NO_BUFFER || input_token->length == 0) {
|
|
Packit Service |
99d1c0 |
envstr = getenv("HOPS");
|
|
Packit Service |
99d1c0 |
hops = (envstr != NULL) ? atoi(envstr) : 1;
|
|
Packit Service |
99d1c0 |
assert(hops > 0);
|
|
Packit Service |
99d1c0 |
} else if (input_token->length == 4 &&
|
|
Packit Service |
99d1c0 |
memcmp(input_token->value, "fail", 4) == 0) {
|
|
Packit Service |
99d1c0 |
*minor_status = 12345;
|
|
Packit Service |
99d1c0 |
return GSS_S_FAILURE;
|
|
Packit Service |
99d1c0 |
} else {
|
|
Packit Service |
99d1c0 |
hops = ((uint8_t *)input_token->value)[0];
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
mech_last_octet = ((uint8_t *)mech_type->elements)[mech_type->length - 1];
|
|
Packit Service |
99d1c0 |
envstr = getenv("INIT_FAIL");
|
|
Packit Service |
99d1c0 |
if (envstr != NULL && atoi(envstr) == mech_last_octet)
|
|
Packit Service |
99d1c0 |
return GSS_S_FAILURE;
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if (ctx == NULL) {
|
|
Packit Service |
99d1c0 |
ctx = malloc(sizeof(*ctx));
|
|
Packit Service |
99d1c0 |
assert(ctx != NULL);
|
|
Packit Service |
99d1c0 |
ctx->initiator = 1;
|
|
Packit Service |
99d1c0 |
ctx->hops = hops;
|
|
Packit Service |
99d1c0 |
*context_handle = (gss_ctx_id_t)ctx;
|
|
Packit Service |
99d1c0 |
} else if (ctx != NULL) {
|
|
Packit Service |
99d1c0 |
assert(ctx->initiator);
|
|
Packit Service |
99d1c0 |
ctx->hops--;
|
|
Packit Service |
99d1c0 |
assert(ctx->hops == hops);
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if (ctx->hops > 0) {
|
|
Packit Service |
99d1c0 |
/* Generate a token containing the remaining hop count. */
|
|
Packit Service |
99d1c0 |
ctx->hops--;
|
|
Packit Service |
99d1c0 |
tok.value = &ctx->hops;
|
|
Packit Service |
99d1c0 |
tok.length = 1;
|
|
Packit Service |
99d1c0 |
major = gss_encapsulate_token(&tok, mech_type, output_token);
|
|
Packit Service |
99d1c0 |
assert(major == GSS_S_COMPLETE);
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
return (ctx->hops > 0) ? GSS_S_CONTINUE_NEEDED : GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_accept_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
|
|
Packit Service |
99d1c0 |
gss_cred_id_t verifier_cred_handle,
|
|
Packit Service |
99d1c0 |
gss_buffer_t input_token,
|
|
Packit Service |
99d1c0 |
gss_channel_bindings_t input_chan_bindings,
|
|
Packit Service |
99d1c0 |
gss_name_t *src_name, gss_OID *mech_type,
|
|
Packit Service |
99d1c0 |
gss_buffer_t output_token, OM_uint32 *ret_flags,
|
|
Packit Service |
99d1c0 |
OM_uint32 *time_rec,
|
|
Packit Service |
99d1c0 |
gss_cred_id_t *delegated_cred_handle)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
struct test_context *ctx = (struct test_context *)*context_handle;
|
|
Packit Service |
99d1c0 |
uint8_t hops, mech_last_octet;
|
|
Packit Service |
99d1c0 |
const char *envstr;
|
|
Packit Service |
99d1c0 |
|
|
rpm-build |
88d58e |
envstr = getenv("GSS_ACCEPT_BINDING");
|
|
rpm-build |
88d58e |
if (envstr != NULL) {
|
|
rpm-build |
88d58e |
assert(strlen(envstr) > 0);
|
|
rpm-build |
88d58e |
assert(input_chan_bindings != GSS_C_NO_CHANNEL_BINDINGS);
|
|
rpm-build |
88d58e |
assert(strlen(envstr) == input_chan_bindings->application_data.length);
|
|
rpm-build |
88d58e |
assert(strcmp((char *)input_chan_bindings->application_data.value,
|
|
rpm-build |
88d58e |
envstr) == 0);
|
|
rpm-build |
88d58e |
}
|
|
rpm-build |
88d58e |
|
|
Packit Service |
99d1c0 |
/*
|
|
Packit Service |
99d1c0 |
* The unwrapped token sits at the end and is just one byte giving the
|
|
Packit Service |
99d1c0 |
* remaining number of hops. The final octet of the mech encoding should
|
|
Packit Service |
99d1c0 |
* be just prior to it.
|
|
Packit Service |
99d1c0 |
*/
|
|
Packit Service |
99d1c0 |
assert(input_token->length >= 2);
|
|
Packit Service |
99d1c0 |
hops = ((uint8_t *)input_token->value)[input_token->length - 1];
|
|
Packit Service |
99d1c0 |
mech_last_octet = ((uint8_t *)input_token->value)[input_token->length - 2];
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
envstr = getenv("ACCEPT_FAIL");
|
|
Packit Service |
99d1c0 |
if (envstr != NULL && atoi(envstr) == mech_last_octet) {
|
|
Packit Service |
99d1c0 |
output_token->value = gssalloc_strdup("fail");
|
|
Packit Service |
99d1c0 |
assert(output_token->value != NULL);
|
|
Packit Service |
99d1c0 |
output_token->length = 4;
|
|
Packit Service |
99d1c0 |
return GSS_S_FAILURE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if (*context_handle == GSS_C_NO_CONTEXT) {
|
|
Packit Service |
99d1c0 |
ctx = malloc(sizeof(*ctx));
|
|
Packit Service |
99d1c0 |
assert(ctx != NULL);
|
|
Packit Service |
99d1c0 |
ctx->initiator = 0;
|
|
Packit Service |
99d1c0 |
ctx->hops = hops;
|
|
Packit Service |
99d1c0 |
*context_handle = (gss_ctx_id_t)ctx;
|
|
Packit Service |
99d1c0 |
} else {
|
|
Packit Service |
99d1c0 |
assert(!ctx->initiator);
|
|
Packit Service |
99d1c0 |
ctx->hops--;
|
|
Packit Service |
99d1c0 |
assert(ctx->hops == hops);
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if (ctx->hops > 0) {
|
|
Packit Service |
99d1c0 |
/* Generate a token containing the remaining hop count. */
|
|
Packit Service |
99d1c0 |
ctx->hops--;
|
|
Packit Service |
99d1c0 |
output_token->value = gssalloc_malloc(1);
|
|
Packit Service |
99d1c0 |
assert(output_token->value != NULL);
|
|
Packit Service |
99d1c0 |
memcpy(output_token->value, &ctx->hops, 1);
|
|
Packit Service |
99d1c0 |
output_token->length = 1;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
return (ctx->hops > 0) ? GSS_S_CONTINUE_NEEDED : GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_delete_sec_context(OM_uint32 *minor_status, gss_ctx_id_t *context_handle,
|
|
Packit Service |
99d1c0 |
gss_buffer_t output_token)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
free(*context_handle);
|
|
Packit Service |
99d1c0 |
*context_handle = GSS_C_NO_CONTEXT;
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_acquire_cred(OM_uint32 *minor_status, gss_name_t desired_name,
|
|
Packit Service |
99d1c0 |
OM_uint32 time_req, gss_OID_set desired_mechs,
|
|
Packit Service |
99d1c0 |
gss_cred_usage_t cred_usage,
|
|
Packit Service |
99d1c0 |
gss_cred_id_t *output_cred_handle, gss_OID_set *actual_mechs,
|
|
Packit Service |
99d1c0 |
OM_uint32 *time_rec)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_acquire_cred_with_password(OM_uint32 *minor_status,
|
|
Packit Service |
99d1c0 |
const gss_name_t desired_name,
|
|
Packit Service |
99d1c0 |
const gss_buffer_t password, OM_uint32 time_req,
|
|
Packit Service |
99d1c0 |
const gss_OID_set desired_mechs,
|
|
Packit Service |
99d1c0 |
gss_cred_usage_t cred_usage,
|
|
Packit Service |
99d1c0 |
gss_cred_id_t *output_cred_handle,
|
|
Packit Service |
99d1c0 |
gss_OID_set *actual_mechs, OM_uint32 *time_rec)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_release_cred(OM_uint32 *minor_status, gss_cred_id_t *cred_handle)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_import_name(OM_uint32 *minor_status, gss_buffer_t input_name_buffer,
|
|
Packit Service |
99d1c0 |
gss_OID input_name_type, gss_name_t *output_name)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
static int dummy;
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
/*
|
|
Packit Service |
99d1c0 |
* We don't need to remember anything about names, but we do need to
|
|
Packit Service |
99d1c0 |
* distinguish them from GSS_C_NO_NAME (to determine the direction of
|
|
Packit Service |
99d1c0 |
* gss_query_meta_data() and gss_exchange_meta_data()), so assign an
|
|
Packit Service |
99d1c0 |
* arbitrary data pointer.
|
|
Packit Service |
99d1c0 |
*/
|
|
Packit Service |
99d1c0 |
*output_name = (gss_name_t)&dummy;
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_release_name(OM_uint32 *minor_status, gss_name_t *input_name)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_display_status(OM_uint32 *minor_status, OM_uint32 status_value,
|
|
Packit Service |
99d1c0 |
int status_type, gss_OID mech_type,
|
|
Packit Service |
99d1c0 |
OM_uint32 *message_context, gss_buffer_t status_string)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
if (status_type == GSS_C_MECH_CODE && status_value == 12345) {
|
|
Packit Service |
99d1c0 |
status_string->value = gssalloc_strdup("failure from acceptor");
|
|
Packit Service |
99d1c0 |
assert(status_string->value != NULL);
|
|
Packit Service |
99d1c0 |
status_string->length = strlen(status_string->value);
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
return GSS_S_BAD_STATUS;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gssspi_query_meta_data(OM_uint32 *minor_status, gss_const_OID mech_oid,
|
|
Packit Service |
99d1c0 |
gss_cred_id_t cred_handle, gss_ctx_id_t *context_handle,
|
|
Packit Service |
99d1c0 |
const gss_name_t targ_name, OM_uint32 req_flags,
|
|
Packit Service |
99d1c0 |
gss_buffer_t meta_data)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
const char *envstr;
|
|
Packit Service |
99d1c0 |
uint8_t mech_last_octet;
|
|
Packit Service |
99d1c0 |
int initiator = (targ_name != GSS_C_NO_NAME);
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
mech_last_octet = ((uint8_t *)mech_oid->elements)[mech_oid->length - 1];
|
|
Packit Service |
99d1c0 |
envstr = getenv(initiator ? "INIT_QUERY_FAIL" : "ACCEPT_QUERY_FAIL");
|
|
Packit Service |
99d1c0 |
if (envstr != NULL && atoi(envstr) == mech_last_octet)
|
|
Packit Service |
99d1c0 |
return GSS_S_FAILURE;
|
|
Packit Service |
99d1c0 |
envstr = getenv(initiator ? "INIT_QUERY_NONE" : "ACCEPT_QUERY_NONE");
|
|
Packit Service |
99d1c0 |
if (envstr != NULL && atoi(envstr) == mech_last_octet)
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
meta_data->value = gssalloc_strdup("X");
|
|
Packit Service |
99d1c0 |
meta_data->length = 1;
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gssspi_exchange_meta_data(OM_uint32 *minor_status, gss_const_OID mech_oid,
|
|
Packit Service |
99d1c0 |
gss_cred_id_t cred_handle,
|
|
Packit Service |
99d1c0 |
gss_ctx_id_t *context_handle,
|
|
Packit Service |
99d1c0 |
const gss_name_t targ_name, OM_uint32 req_flags,
|
|
Packit Service |
99d1c0 |
gss_const_buffer_t meta_data)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
const char *envstr;
|
|
Packit Service |
99d1c0 |
uint8_t mech_last_octet;
|
|
Packit Service |
99d1c0 |
int initiator = (targ_name != GSS_C_NO_NAME);
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
mech_last_octet = ((uint8_t *)mech_oid->elements)[mech_oid->length - 1];
|
|
Packit Service |
99d1c0 |
envstr = getenv(initiator ? "INIT_EXCHANGE_FAIL" : "ACCEPT_EXCHANGE_FAIL");
|
|
Packit Service |
99d1c0 |
if (envstr != NULL && atoi(envstr) == mech_last_octet)
|
|
Packit Service |
99d1c0 |
return GSS_S_FAILURE;
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
assert(meta_data->length == 1 && memcmp(meta_data->value, "X", 1) == 0);
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gssspi_query_mechanism_info(OM_uint32 *minor_status, gss_const_OID mech_oid,
|
|
Packit Service |
99d1c0 |
unsigned char auth_scheme[16])
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
/* Copy the mech OID encoding and right-pad it with zeros. */
|
|
Packit Service |
99d1c0 |
memset(auth_scheme, 0, 16);
|
|
Packit Service |
99d1c0 |
assert(mech_oid->length <= 16);
|
|
Packit Service |
99d1c0 |
memcpy(auth_scheme, mech_oid->elements, mech_oid->length);
|
|
Packit Service |
99d1c0 |
return GSS_S_COMPLETE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
OM_uint32 KRB5_CALLCONV
|
|
Packit Service |
99d1c0 |
gss_inquire_sec_context_by_oid(OM_uint32 *minor_status,
|
|
Packit Service |
99d1c0 |
const gss_ctx_id_t context_handle,
|
|
Packit Service |
99d1c0 |
const gss_OID desired_object,
|
|
Packit Service |
99d1c0 |
gss_buffer_set_t *data_set)
|
|
Packit Service |
99d1c0 |
{
|
|
Packit Service |
99d1c0 |
struct test_context *ctx = (struct test_context *)context_handle;
|
|
Packit Service |
99d1c0 |
OM_uint32 major;
|
|
Packit Service |
99d1c0 |
uint8_t keybytes[32] = { 0 };
|
|
Packit Service |
99d1c0 |
uint8_t typebytes[4];
|
|
Packit Service |
99d1c0 |
gss_buffer_desc key, type;
|
|
Packit Service |
99d1c0 |
const char *envstr;
|
|
Packit Service |
99d1c0 |
int ask_verify;
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
if (gss_oid_equal(desired_object, GSS_C_INQ_NEGOEX_KEY))
|
|
Packit Service |
99d1c0 |
ask_verify = 0;
|
|
Packit Service |
99d1c0 |
else if (gss_oid_equal(desired_object, GSS_C_INQ_NEGOEX_VERIFY_KEY))
|
|
Packit Service |
99d1c0 |
ask_verify = 1;
|
|
Packit Service |
99d1c0 |
else
|
|
Packit Service |
99d1c0 |
return GSS_S_UNAVAILABLE;
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
/*
|
|
Packit Service |
99d1c0 |
* By default, make a key available only if the context is established.
|
|
Packit Service |
99d1c0 |
* This can be overridden to "always", "init-always", "accept-always",
|
|
Packit Service |
99d1c0 |
* or "never".
|
|
Packit Service |
99d1c0 |
*/
|
|
Packit Service |
99d1c0 |
envstr = getenv("KEY");
|
|
Packit Service |
99d1c0 |
if (envstr != NULL && strcmp(envstr, "never") == 0) {
|
|
Packit Service |
99d1c0 |
return GSS_S_UNAVAILABLE;
|
|
Packit Service |
99d1c0 |
} else if (ctx->hops > 0) {
|
|
Packit Service |
99d1c0 |
if (envstr == NULL)
|
|
Packit Service |
99d1c0 |
return GSS_S_UNAVAILABLE;
|
|
Packit Service |
99d1c0 |
else if (strcmp(envstr, "init-always") == 0 && !ctx->initiator)
|
|
Packit Service |
99d1c0 |
return GSS_S_UNAVAILABLE;
|
|
Packit Service |
99d1c0 |
else if (strcmp(envstr, "accept-always") == 0 && ctx->initiator)
|
|
Packit Service |
99d1c0 |
return GSS_S_UNAVAILABLE;
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
/* Perturb the key so that each side's verifier key is equal to the other's
|
|
Packit Service |
99d1c0 |
* checksum key. */
|
|
Packit Service |
99d1c0 |
keybytes[0] = ask_verify ^ ctx->initiator;
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
/* Supply an all-zeros aes256-sha1 negoex key. */
|
|
Packit Service |
99d1c0 |
if (gss_oid_equal(desired_object, GSS_C_INQ_NEGOEX_KEY) ||
|
|
Packit Service |
99d1c0 |
gss_oid_equal(desired_object, GSS_C_INQ_NEGOEX_VERIFY_KEY)) {
|
|
Packit Service |
99d1c0 |
store_32_le(ENCTYPE_AES256_CTS_HMAC_SHA1_96, typebytes);
|
|
Packit Service |
99d1c0 |
key.value = keybytes;
|
|
Packit Service |
99d1c0 |
key.length = sizeof(keybytes);
|
|
Packit Service |
99d1c0 |
type.value = typebytes;
|
|
Packit Service |
99d1c0 |
type.length = sizeof(typebytes);
|
|
Packit Service |
99d1c0 |
major = gss_add_buffer_set_member(minor_status, &key, data_set);
|
|
Packit Service |
99d1c0 |
if (major != GSS_S_COMPLETE)
|
|
Packit Service |
99d1c0 |
return major;
|
|
Packit Service |
99d1c0 |
return gss_add_buffer_set_member(minor_status, &type, data_set);
|
|
Packit Service |
99d1c0 |
}
|
|
Packit Service |
99d1c0 |
|
|
Packit Service |
99d1c0 |
return GSS_S_UNAVAILABLE;
|
|
Packit Service |
99d1c0 |
}
|