2 * Adapted in part from MIT Kerberos 5-1.2.1 slave/kprop.c and from
3 * http://docs.sun.com/?p=/doc/816-1331/6m7oo9sms&a=view
5 * Copyright (c) 2002 The Regents of the University of Michigan.
8 * Andy Adamson <andros@umich.edu>
9 * J. Bruce Fields <bfields@umich.edu>
10 * Marius Aamodt Eriksen <marius@umich.edu>
16 * Copyright 1990,1991 by the Massachusetts Institute of Technology.
17 * All Rights Reserved.
19 * Export of this software from the United States of America may
20 * require a specific license from the United States Government.
21 * It is the responsibility of any person or organization contemplating
22 * export to obtain such a license before exporting.
24 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
25 * distribute this software and its documentation for any purpose and
26 * without fee is hereby granted, provided that the above copyright
27 * notice appear in all copies and that both that copyright notice and
28 * this permission notice appear in supporting documentation, and that
29 * the name of M.I.T. not be used in advertising or publicity pertaining
30 * to distribution of the software without specific, written prior
31 * permission. Furthermore if you modify this software you must label
32 * your software as modified software and not distribute it in such a
33 * fashion that it might be confused with the original M.I.T. software.
34 * M.I.T. makes no representations about the suitability of
35 * this software for any purpose. It is provided "as is" without express
36 * or implied warranty.
40 * Copyright 1994 by OpenVision Technologies, Inc.
42 * Permission to use, copy, modify, distribute, and sell this software
43 * and its documentation for any purpose is hereby granted without fee,
44 * provided that the above copyright notice appears in all copies and
45 * that both that copyright notice and this permission notice appear in
46 * supporting documentation, and that the name of OpenVision not be used
47 * in advertising or publicity pertaining to distribution of the software
48 * without specific, written prior permission. OpenVision makes no
49 * representations about the suitability of this software for any
50 * purpose. It is provided "as is" without express or implied warranty.
52 * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
53 * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
54 * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
55 * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
56 * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
57 * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
58 * PERFORMANCE OF THIS SOFTWARE.
63 #endif /* HAVE_CONFIG_H */
71 #include <sys/types.h>
74 #include <sys/socket.h>
75 #include <netinet/in.h>
76 #include <sys/param.h>
79 #include <gssapi/gssapi.h>
80 #if defined(HAVE_KRB5) && !defined(GSS_C_NT_HOSTBASED_SERVICE)
81 #include <gssapi/gssapi_generic.h>
82 #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
95 /* Global gssd_credentials handle */
96 gss_cred_id_t gssd_creds;
98 gss_OID g_mechOid = GSS_C_NULL_OID;;
102 display_status_1(char *m, u_int32_t code, int type, const gss_OID mech)
104 u_int32_t maj_stat, min_stat;
105 gss_buffer_desc msg = GSS_C_EMPTY_BUFFER;
106 u_int32_t msg_ctx = 0;
113 case GSS_C_MECH_CODE:
114 typestr = "mechanism";
122 maj_stat = gss_display_status(&min_stat, code,
123 type, mech, &msg_ctx, &msg);
124 if (maj_stat != GSS_S_COMPLETE) {
125 printerr(0, "ERROR: in call to "
126 "gss_display_status called from %s\n", m);
129 printerr(0, "ERROR: GSS-API: (%s) error in %s(): %s\n",
130 typestr, m, (char *)msg.value);
134 (void) gss_release_buffer(&min_stat, &msg);
142 gss_display_error(OM_uint32 status)
148 error = "GSS_S_COMPLETE";
150 case GSS_S_CALL_INACCESSIBLE_READ:
151 error = "GSS_S_CALL_INACCESSIBLE_READ";
153 case GSS_S_CALL_INACCESSIBLE_WRITE:
154 error = "GSS_S_CALL_INACCESSIBLE_WRITE";
156 case GSS_S_CALL_BAD_STRUCTURE:
157 error = "GSS_S_CALL_BAD_STRUCTURE";
160 error = "GSS_S_BAD_MECH";
163 error = "GSS_S_BAD_NAME";
165 case GSS_S_BAD_NAMETYPE:
166 error = "GSS_S_BAD_NAMETYPE";
168 case GSS_S_BAD_BINDINGS:
169 error = "GSS_S_BAD_BINDINGS";
171 case GSS_S_BAD_STATUS:
172 error = "GSS_S_BAD_STATUS";
175 error = "GSS_S_BAD_SIG";
178 error = "GSS_S_NO_CRED";
180 case GSS_S_NO_CONTEXT:
181 error = "GSS_S_NO_CONTEXT";
183 case GSS_S_DEFECTIVE_TOKEN:
184 error = "GSS_S_DEFECTIVE_TOKEN";
186 case GSS_S_DEFECTIVE_CREDENTIAL:
187 error = "GSS_S_DEFECTIVE_CREDENTIAL";
189 case GSS_S_CREDENTIALS_EXPIRED:
190 error = "GSS_S_CREDENTIALS_EXPIRED";
192 case GSS_S_CONTEXT_EXPIRED:
193 error = "GSS_S_CONTEXT_EXPIRED";
196 error = "GSS_S_FAILURE";
199 error = "GSS_S_BAD_QOP";
201 case GSS_S_UNAUTHORIZED:
202 error = "GSS_S_UNAUTHORIZED";
204 case GSS_S_UNAVAILABLE:
205 error = "GSS_S_UNAVAILABLE";
207 case GSS_S_DUPLICATE_ELEMENT:
208 error = "GSS_S_DUPLICATE_ELEMENT";
210 case GSS_S_NAME_NOT_MN:
211 error = "GSS_S_NAME_NOT_MN";
214 error = "Not defined";
220 display_status_2(char *m, u_int32_t major, u_int32_t minor, const gss_OID mech)
222 u_int32_t maj_stat1, min_stat1;
223 u_int32_t maj_stat2, min_stat2;
224 gss_buffer_desc maj_gss_buf = GSS_C_EMPTY_BUFFER;
225 gss_buffer_desc min_gss_buf = GSS_C_EMPTY_BUFFER;
226 char maj_buf[30], min_buf[30];
228 u_int32_t msg_ctx = 0;
229 int msg_verbosity = 0;
231 /* Get major status message */
232 maj_stat1 = gss_display_status(&min_stat1, major,
233 GSS_C_GSS_CODE, mech, &msg_ctx, &maj_gss_buf);
235 if (maj_stat1 != GSS_S_COMPLETE) {
236 snprintf(maj_buf, sizeof(maj_buf), "(0x%08x)", major);
239 maj = maj_gss_buf.value;
242 /* Get minor status message */
243 maj_stat2 = gss_display_status(&min_stat2, minor,
244 GSS_C_MECH_CODE, mech, &msg_ctx, &min_gss_buf);
246 if (maj_stat2 != GSS_S_COMPLETE) {
247 snprintf(min_buf, sizeof(min_buf), "(0x%08x)", minor);
250 min = min_gss_buf.value;
253 if (major == GSS_S_CREDENTIALS_EXPIRED)
255 printerr(msg_verbosity, "ERROR: GSS-API: error in %s(): %s (%s) - %s(%s)\n",
256 m, gss_display_error(major), maj, min);
258 if (maj_gss_buf.length != 0)
259 (void) gss_release_buffer(&min_stat1, &maj_gss_buf);
260 if (min_gss_buf.length != 0)
261 (void) gss_release_buffer(&min_stat2, &min_gss_buf);
265 pgsserr(char *msg, u_int32_t maj_stat, u_int32_t min_stat, const gss_OID mech)
267 display_status_2(msg, maj_stat, min_stat, mech);
271 gssd_acquire_cred(char *server_name, const gss_OID oid)
273 gss_buffer_desc name;
274 gss_name_t target_name;
275 u_int32_t maj_stat, min_stat;
276 u_int32_t ignore_maj_stat, ignore_min_stat;
277 gss_buffer_desc pbuf;
279 /* If server_name is NULL, get cred for GSS_C_NO_NAME */
280 if (server_name == NULL) {
281 target_name = GSS_C_NO_NAME;
283 name.value = (void *)server_name;
284 name.length = strlen(server_name);
286 maj_stat = gss_import_name(&min_stat, &name,
290 if (maj_stat != GSS_S_COMPLETE) {
291 pgsserr("gss_import_name", maj_stat, min_stat, g_mechOid);
296 maj_stat = gss_acquire_cred(&min_stat, target_name, GSS_C_INDEFINITE,
297 GSS_C_NO_OID_SET, GSS_C_ACCEPT,
298 &gssd_creds, NULL, NULL);
300 if (maj_stat != GSS_S_COMPLETE) {
301 pgsserr("gss_acquire_cred", maj_stat, min_stat, g_mechOid);
302 ignore_maj_stat = gss_display_name(&ignore_min_stat,
303 target_name, &pbuf, NULL);
304 if (ignore_maj_stat == GSS_S_COMPLETE) {
305 printerr(1, "Unable to obtain credentials for '%.*s'\n",
306 pbuf.length, pbuf.value);
307 ignore_maj_stat = gss_release_buffer(&ignore_min_stat,
312 ignore_maj_stat = gss_release_name(&ignore_min_stat, &target_name);
314 return (maj_stat == GSS_S_COMPLETE);
317 int gssd_check_mechs(void)
319 u_int32_t maj_stat, min_stat;
320 gss_OID_set supported_mechs = GSS_C_NO_OID_SET;
323 maj_stat = gss_indicate_mechs(&min_stat, &supported_mechs);
324 if (maj_stat != GSS_S_COMPLETE) {
325 printerr(0, "Unable to obtain list of supported mechanisms. "
326 "Check that gss library is properly configured.\n");
329 if (supported_mechs == GSS_C_NO_OID_SET ||
330 supported_mechs->count == 0) {
331 printerr(0, "Unable to obtain list of supported mechanisms. "
332 "Check that gss library is properly configured.\n");
335 maj_stat = gss_release_oid_set(&min_stat, &supported_mechs);