No empty .Rs/.Re
[netbsd-mini2440.git] / crypto / dist / heimdal / lib / krb5 / verify_init.c
blob78fb5245aae7baa17e213d5a9371ba009f5a5a42
1 /*
2 * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
34 #include "krb5_locl.h"
36 __RCSID("$Heimdal: verify_init.c 15555 2005-07-06 00:48:16Z lha $"
37 "$NetBSD$");
39 void KRB5_LIB_FUNCTION
40 krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options)
42 memset (options, 0, sizeof(*options));
45 void KRB5_LIB_FUNCTION
46 krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options,
47 int ap_req_nofail)
49 options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
50 options->ap_req_nofail = ap_req_nofail;
57 static krb5_boolean
58 fail_verify_is_ok (krb5_context context,
59 krb5_verify_init_creds_opt *options)
61 if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL
62 && options->ap_req_nofail != 0)
63 || krb5_config_get_bool (context,
64 NULL,
65 "libdefaults",
66 "verify_ap_req_nofail",
67 NULL))
68 return FALSE;
69 else
70 return TRUE;
73 krb5_error_code KRB5_LIB_FUNCTION
74 krb5_verify_init_creds(krb5_context context,
75 krb5_creds *creds,
76 krb5_principal ap_req_server,
77 krb5_keytab ap_req_keytab,
78 krb5_ccache *ccache,
79 krb5_verify_init_creds_opt *options)
81 krb5_error_code ret;
82 krb5_data req;
83 krb5_ccache local_ccache = NULL;
84 krb5_creds *new_creds = NULL;
85 krb5_auth_context auth_context = NULL;
86 krb5_principal server = NULL;
87 krb5_keytab keytab = NULL;
89 krb5_data_zero (&req);
91 if (ap_req_server == NULL) {
92 char local_hostname[MAXHOSTNAMELEN];
94 if (gethostname (local_hostname, sizeof(local_hostname)) < 0) {
95 ret = errno;
96 krb5_set_error_string (context, "gethostname: %s",
97 strerror(ret));
98 return ret;
101 ret = krb5_sname_to_principal (context,
102 local_hostname,
103 "host",
104 KRB5_NT_SRV_HST,
105 &server);
106 if (ret)
107 goto cleanup;
108 } else
109 server = ap_req_server;
111 if (ap_req_keytab == NULL) {
112 ret = krb5_kt_default (context, &keytab);
113 if (ret)
114 goto cleanup;
115 } else
116 keytab = ap_req_keytab;
118 if (ccache && *ccache)
119 local_ccache = *ccache;
120 else {
121 ret = krb5_cc_gen_new (context, &krb5_mcc_ops, &local_ccache);
122 if (ret)
123 goto cleanup;
124 ret = krb5_cc_initialize (context,
125 local_ccache,
126 creds->client);
127 if (ret)
128 goto cleanup;
129 ret = krb5_cc_store_cred (context,
130 local_ccache,
131 creds);
132 if (ret)
133 goto cleanup;
136 if (!krb5_principal_compare (context, server, creds->server)) {
137 krb5_creds match_cred;
139 memset (&match_cred, 0, sizeof(match_cred));
141 match_cred.client = creds->client;
142 match_cred.server = server;
144 ret = krb5_get_credentials (context,
146 local_ccache,
147 &match_cred,
148 &new_creds);
149 if (ret) {
150 if (fail_verify_is_ok (context, options))
151 ret = 0;
152 goto cleanup;
154 creds = new_creds;
157 ret = krb5_mk_req_extended (context,
158 &auth_context,
160 NULL,
161 creds,
162 &req);
164 krb5_auth_con_free (context, auth_context);
165 auth_context = NULL;
167 if (ret)
168 goto cleanup;
170 ret = krb5_rd_req (context,
171 &auth_context,
172 &req,
173 server,
174 keytab,
176 NULL);
178 if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options))
179 ret = 0;
180 cleanup:
181 if (auth_context)
182 krb5_auth_con_free (context, auth_context);
183 krb5_data_free (&req);
184 if (new_creds != NULL)
185 krb5_free_creds (context, new_creds);
186 if (ap_req_server == NULL && server)
187 krb5_free_principal (context, server);
188 if (ap_req_keytab == NULL && keytab)
189 krb5_kt_close (context, keytab);
190 if (local_ccache != NULL
192 (ccache == NULL
193 || (ret != 0 && *ccache == NULL)))
194 krb5_cc_destroy (context, local_ccache);
196 if (ret == 0 && ccache != NULL && *ccache == NULL)
197 *ccache = local_ccache;
199 return ret;