2 * Adapted in part from MIT Kerberos 5-1.2.1 slave/kprop.c and from
3 * http://docs.sun.com/?p=/doc/816-1331/6m7oo9sms&a=view
5 * Copyright (c) 2002 The Regents of the University of Michigan.
8 * Andy Adamson <andros@umich.edu>
9 * J. Bruce Fields <bfields@umich.edu>
10 * Marius Aamodt Eriksen <marius@umich.edu>
16 * Copyright 1990,1991 by the Massachusetts Institute of Technology.
17 * All Rights Reserved.
19 * Export of this software from the United States of America may
20 * require a specific license from the United States Government.
21 * It is the responsibility of any person or organization contemplating
22 * export to obtain such a license before exporting.
24 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
25 * distribute this software and its documentation for any purpose and
26 * without fee is hereby granted, provided that the above copyright
27 * notice appear in all copies and that both that copyright notice and
28 * this permission notice appear in supporting documentation, and that
29 * the name of M.I.T. not be used in advertising or publicity pertaining
30 * to distribution of the software without specific, written prior
31 * permission. Furthermore if you modify this software you must label
32 * your software as modified software and not distribute it in such a
33 * fashion that it might be confused with the original M.I.T. software.
34 * M.I.T. makes no representations about the suitability of
35 * this software for any purpose. It is provided "as is" without express
36 * or implied warranty.
40 * Copyright 1994 by OpenVision Technologies, Inc.
42 * Permission to use, copy, modify, distribute, and sell this software
43 * and its documentation for any purpose is hereby granted without fee,
44 * provided that the above copyright notice appears in all copies and
45 * that both that copyright notice and this permission notice appear in
46 * supporting documentation, and that the name of OpenVision not be used
47 * in advertising or publicity pertaining to distribution of the software
48 * without specific, written prior permission. OpenVision makes no
49 * representations about the suitability of this software for any
50 * purpose. It is provided "as is" without express or implied warranty.
52 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
53 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
54 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
55 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
56 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
57 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
58 * PERFORMANCE OF THIS SOFTWARE.
63 #endif /* HAVE_CONFIG_H */
71 #include <sys/types.h>
74 #include <sys/socket.h>
75 #include <netinet/in.h>
76 #include <sys/param.h>
79 #include <gssapi/gssapi.h>
80 #if defined(HAVE_KRB5) && !defined(GSS_C_NT_HOSTBASED_SERVICE)
81 #include <gssapi/gssapi_generic.h>
82 #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
95 /* Global gssd_credentials handle */
96 gss_cred_id_t gssd_creds
;
98 gss_OID g_mechOid
= GSS_C_NULL_OID
;;
102 display_status_1(char *m
, u_int32_t code
, int type
, const gss_OID mech
)
104 u_int32_t maj_stat
, min_stat
;
105 gss_buffer_desc msg
= GSS_C_EMPTY_BUFFER
;
106 u_int32_t msg_ctx
= 0;
113 case GSS_C_MECH_CODE
:
114 typestr
= "mechanism";
122 maj_stat
= gss_display_status(&min_stat
, code
,
123 type
, mech
, &msg_ctx
, &msg
);
124 if (maj_stat
!= GSS_S_COMPLETE
) {
125 printerr(0, "ERROR: in call to "
126 "gss_display_status called from %s\n", m
);
129 printerr(0, "ERROR: GSS-API: (%s) error in %s(): %s\n",
130 typestr
, m
, (char *)msg
.value
);
134 (void) gss_release_buffer(&min_stat
, &msg
);
143 display_status_2(char *m
, u_int32_t major
, u_int32_t minor
, const gss_OID mech
)
145 u_int32_t maj_stat1
, min_stat1
;
146 u_int32_t maj_stat2
, min_stat2
;
147 gss_buffer_desc maj_gss_buf
= GSS_C_EMPTY_BUFFER
;
148 gss_buffer_desc min_gss_buf
= GSS_C_EMPTY_BUFFER
;
149 char maj_buf
[30], min_buf
[30];
151 u_int32_t msg_ctx
= 0;
152 int msg_verbosity
= 0;
154 /* Get major status message */
155 maj_stat1
= gss_display_status(&min_stat1
, major
,
156 GSS_C_GSS_CODE
, mech
, &msg_ctx
, &maj_gss_buf
);
158 if (maj_stat1
!= GSS_S_COMPLETE
) {
159 snprintf(maj_buf
, sizeof(maj_buf
), "(0x%08x)", major
);
162 maj
= maj_gss_buf
.value
;
165 /* Get minor status message */
166 maj_stat2
= gss_display_status(&min_stat2
, minor
,
167 GSS_C_MECH_CODE
, mech
, &msg_ctx
, &min_gss_buf
);
169 if (maj_stat2
!= GSS_S_COMPLETE
) {
170 snprintf(min_buf
, sizeof(min_buf
), "(0x%08x)", minor
);
173 min
= min_gss_buf
.value
;
176 if (major
== GSS_S_CREDENTIALS_EXPIRED
)
178 printerr(msg_verbosity
, "ERROR: GSS-API: error in %s(): %s - %s\n",
181 if (maj_gss_buf
.length
!= 0)
182 (void) gss_release_buffer(&min_stat1
, &maj_gss_buf
);
183 if (min_gss_buf
.length
!= 0)
184 (void) gss_release_buffer(&min_stat2
, &min_gss_buf
);
188 pgsserr(char *msg
, u_int32_t maj_stat
, u_int32_t min_stat
, const gss_OID mech
)
190 display_status_2(msg
, maj_stat
, min_stat
, mech
);
194 gssd_acquire_cred(char *server_name
)
196 gss_buffer_desc name
;
197 gss_name_t target_name
;
198 u_int32_t maj_stat
, min_stat
;
199 u_int32_t ignore_maj_stat
, ignore_min_stat
;
200 gss_buffer_desc pbuf
;
202 name
.value
= (void *)server_name
;
203 name
.length
= strlen(server_name
);
205 maj_stat
= gss_import_name(&min_stat
, &name
,
206 (const gss_OID
) GSS_C_NT_HOSTBASED_SERVICE
,
209 if (maj_stat
!= GSS_S_COMPLETE
) {
210 pgsserr("gss_import_name", maj_stat
, min_stat
, g_mechOid
);
214 maj_stat
= gss_acquire_cred(&min_stat
, target_name
, 0,
215 GSS_C_NULL_OID_SET
, GSS_C_ACCEPT
,
216 &gssd_creds
, NULL
, NULL
);
218 if (maj_stat
!= GSS_S_COMPLETE
) {
219 pgsserr("gss_acquire_cred", maj_stat
, min_stat
, g_mechOid
);
220 ignore_maj_stat
= gss_display_name(&ignore_min_stat
,
221 target_name
, &pbuf
, NULL
);
222 if (ignore_maj_stat
== GSS_S_COMPLETE
) {
223 printerr(1, "Unable to obtain credentials for '%.*s'\n",
224 pbuf
.length
, pbuf
.value
);
225 ignore_maj_stat
= gss_release_buffer(&ignore_min_stat
,
230 ignore_maj_stat
= gss_release_name(&ignore_min_stat
, &target_name
);
232 return (maj_stat
== GSS_S_COMPLETE
);
235 int gssd_check_mechs(void)
237 u_int32_t maj_stat
, min_stat
;
238 gss_OID_set supported_mechs
= GSS_C_NO_OID_SET
;
241 maj_stat
= gss_indicate_mechs(&min_stat
, &supported_mechs
);
242 if (maj_stat
!= GSS_S_COMPLETE
) {
243 printerr(0, "Unable to obtain list of supported mechanisms. "
244 "Check that gss library is properly configured.\n");
247 if (supported_mechs
== GSS_C_NO_OID_SET
||
248 supported_mechs
->count
== 0) {
249 printerr(0, "Unable to obtain list of supported mechanisms. "
250 "Check that gss library is properly configured.\n");
253 maj_stat
= gss_release_oid_set(&min_stat
, &supported_mechs
);