1 files changed, 32 insertions, 74 deletions

diff --git a/source4/heimdal/lib/gssapi/accept_sec_context.c b/source4/heimdal/lib/gssapi/accept_sec_context.c
index 5d43cdcb43..9ca60a6cdd 100644
--- a/source4/heimdal/lib/gssapi/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/accept_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "gssapi_locl.h"
 
-RCSID("$Id: accept_sec_context.c,v 1.53 2005/05/29 15:12:41 lha Exp $");
+RCSID("$Id: accept_sec_context.c,v 1.55 2005/11/25 15:57:35 lha Exp $");
 
 HEIMDAL_MUTEX gssapi_keytab_mutex = HEIMDAL_MUTEX_INITIALIZER;
 krb5_keytab gssapi_krb5_keytab;
@@ -125,66 +125,24 @@ gsskrb5_accept_delegated_token
     krb5_principal principal = (*context_handle)->source;
     krb5_ccache ccache = NULL;
     krb5_error_code kret;
-    int32_t ac_flags, ret;
-    gss_cred_id_t handle = NULL;
+    int32_t ac_flags, ret = GSS_S_COMPLETE;
       
-    if (delegated_cred_handle == NULL) {
-	/* XXX Create a new delegated_cred_handle? */
-
-	ret = 0;
+    *minor_status = 0;
 
+    /* XXX Create a new delegated_cred_handle? */
+    if (delegated_cred_handle == NULL)
 	kret = krb5_cc_default (gssapi_krb5_context, &ccache);
-	if (kret) {
-	    *flags &= ~GSS_C_DELEG_FLAG;
-	    goto end_fwd;
-	}
-    } else {
-
-	*delegated_cred_handle = NULL;
-	
-	handle = calloc(1, sizeof(*handle));
-	if (handle == NULL) {
-	    ret = GSS_S_FAILURE;
-	    *minor_status = ENOMEM;
-	    krb5_set_error_string(gssapi_krb5_context, "out of memory");
-	    gssapi_krb5_set_error_string();
-	    *flags &= ~GSS_C_DELEG_FLAG;
-	    goto end_fwd;
-	}
-	if ((ret = gss_duplicate_name(minor_status, principal,
-				      &handle->principal)) != 0) {
-	    *flags &= ~GSS_C_DELEG_FLAG;
-	    ret = 0;
-	    goto end_fwd;
-	}
-	kret = krb5_cc_gen_new (gssapi_krb5_context,
-				&krb5_mcc_ops,
-				&handle->ccache);
-	if (kret) {
-	    *flags &= ~GSS_C_DELEG_FLAG;
-	    ret = 0;
-	    goto end_fwd;
-	}
-	ccache = handle->ccache;
-
-	ret = gss_create_empty_oid_set(minor_status, &handle->mechanisms);
-	if (ret) {
-	    *flags &= ~GSS_C_DELEG_FLAG;
-	    goto end_fwd;
-	}
-	ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM,
-				     &handle->mechanisms);
-	if (ret) {
-	    *flags &= ~GSS_C_DELEG_FLAG;
-	    goto end_fwd;
-	}
+    else
+	kret = krb5_cc_gen_new (gssapi_krb5_context, &krb5_mcc_ops, &ccache);
+    if (kret) {
+	*flags &= ~GSS_C_DELEG_FLAG;
+	goto out;
     }
 
     kret = krb5_cc_initialize(gssapi_krb5_context, ccache, principal);
     if (kret) {
 	*flags &= ~GSS_C_DELEG_FLAG;
-	ret = 0;
-	goto end_fwd;
+	goto out;
     }
       
     krb5_auth_con_removeflags(gssapi_krb5_context,
@@ -204,29 +162,29 @@ gsskrb5_accept_delegated_token
 	*flags &= ~GSS_C_DELEG_FLAG;
 	ret = GSS_S_FAILURE;
 	*minor_status = kret;
-	goto end_fwd;
+	goto out;
     }
- end_fwd:
-    /* if there was some kind of failure, clean up internal structures */
-    if ((*flags & GSS_C_DELEG_FLAG) == 0) {
-	if (handle) {
-	    if (handle->principal)
-		gss_release_name(minor_status, &handle->principal);
-	    if (handle->mechanisms)
-		gss_release_oid_set(NULL, &handle->mechanisms);
-	    if (handle->ccache)
-		krb5_cc_destroy(gssapi_krb5_context, handle->ccache);
-	    free(handle);
-	    handle = NULL;
-	}
+
+    if (delegated_cred_handle) {
+	ret = gss_krb5_import_cred(minor_status,
+				   ccache,
+				   NULL,
+				   NULL,
+				   delegated_cred_handle);
+	if (ret != GSS_S_COMPLETE)
+	    goto out;
+
+	(*delegated_cred_handle)->cred_flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
+	ccache = NULL;
     }
-    if (delegated_cred_handle == NULL) {
-	if (ccache)
+
+out:
+    if (ccache) {
+	if (delegated_cred_handle == NULL)
 	    krb5_cc_close(gssapi_krb5_context, ccache);
+	else
+	    krb5_cc_destroy(gssapi_krb5_context, ccache);
     }
-    if (handle)
-	*delegated_cred_handle = handle;
-
     return ret;
 }
 
@@ -1054,7 +1012,7 @@ spnego_accept_sec_context
     if(len > data.length - taglen)
 	return ASN1_OVERRUN;
 
-    ret = decode_NegTokenInit((const char *)data.data + taglen, len,
+    ret = decode_NegTokenInit((const unsigned char *)data.data + taglen, len,
 			      &ni, &ni_len);
     if (ret)
 	return GSS_S_DEFECTIVE_TOKEN;
@@ -1065,7 +1023,7 @@ spnego_accept_sec_context
     }
 
     for (i = 0; !found && i < ni.mechTypes->len; ++i) {
-	char mechbuf[17];
+	unsigned char mechbuf[17];
 	size_t mech_len;
 
 	ret = der_put_oid (mechbuf + sizeof(mechbuf) - 1,