summaryrefslogtreecommitdiff
path: root/source4/heimdal/lib/gssapi
diff options
context:
space:
mode:
Diffstat (limited to 'source4/heimdal/lib/gssapi')
-rw-r--r--source4/heimdal/lib/gssapi/krb5/acquire_cred.c4
-rw-r--r--source4/heimdal/lib/gssapi/krb5/display_name.c5
-rw-r--r--source4/heimdal/lib/gssapi/krb5/prf.c3
-rw-r--r--source4/heimdal/lib/gssapi/krb5/release_name.c5
-rw-r--r--source4/heimdal/lib/gssapi/mech/context.c6
-rw-r--r--source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c10
-rw-r--r--source4/heimdal/lib/gssapi/mech/gss_display_name.c7
-rw-r--r--source4/heimdal/lib/gssapi/mech/gss_display_status.c8
-rw-r--r--source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c39
-rw-r--r--source4/heimdal/lib/gssapi/mech/gss_inquire_context.c11
-rw-r--r--source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c14
-rw-r--r--source4/heimdal/lib/gssapi/mech/gss_krb5.c4
-rw-r--r--source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c6
-rw-r--r--source4/heimdal/lib/gssapi/spnego/accept_sec_context.c135
14 files changed, 136 insertions, 121 deletions
diff --git a/source4/heimdal/lib/gssapi/krb5/acquire_cred.c b/source4/heimdal/lib/gssapi/krb5/acquire_cred.c
index 42b57cdadd..d5c70636bc 100644
--- a/source4/heimdal/lib/gssapi/krb5/acquire_cred.c
+++ b/source4/heimdal/lib/gssapi/krb5/acquire_cred.c
@@ -33,7 +33,7 @@
#include "krb5/gsskrb5_locl.h"
-RCSID("$Id: acquire_cred.c 20688 2007-05-17 18:44:31Z lha $");
+RCSID("$Id: acquire_cred.c 21221 2007-06-20 08:42:10Z lha $");
OM_uint32
__gsskrb5_ccache_lifetime(OM_uint32 *minor_status,
@@ -256,8 +256,8 @@ static OM_uint32 acquire_acceptor_cred
if (kret)
goto end;
krb5_kt_free_entry(context, &entry);
+ ret = GSS_S_COMPLETE;
}
- ret = GSS_S_COMPLETE;
end:
if (ret != GSS_S_COMPLETE) {
diff --git a/source4/heimdal/lib/gssapi/krb5/display_name.c b/source4/heimdal/lib/gssapi/krb5/display_name.c
index 93fac8d67b..727c447d2a 100644
--- a/source4/heimdal/lib/gssapi/krb5/display_name.c
+++ b/source4/heimdal/lib/gssapi/krb5/display_name.c
@@ -33,7 +33,7 @@
#include "krb5/gsskrb5_locl.h"
-RCSID("$Id: display_name.c 19031 2006-11-13 18:02:57Z lha $");
+RCSID("$Id: display_name.c 21077 2007-06-12 22:42:56Z lha $");
OM_uint32 _gsskrb5_display_name
(OM_uint32 * minor_status,
@@ -50,7 +50,8 @@ OM_uint32 _gsskrb5_display_name
GSSAPI_KRB5_INIT (&context);
- kret = krb5_unparse_name (context, name, &buf);
+ kret = krb5_unparse_name_flags (context, name,
+ KRB5_PRINCIPAL_UNPARSE_DISPLAY, &buf);
if (kret) {
*minor_status = kret;
return GSS_S_FAILURE;
diff --git a/source4/heimdal/lib/gssapi/krb5/prf.c b/source4/heimdal/lib/gssapi/krb5/prf.c
index 3eb90d279f..f79c9374a9 100644
--- a/source4/heimdal/lib/gssapi/krb5/prf.c
+++ b/source4/heimdal/lib/gssapi/krb5/prf.c
@@ -33,7 +33,7 @@
#include "krb5/gsskrb5_locl.h"
-RCSID("$Id: prf.c 20679 2007-05-14 03:12:05Z lha $");
+RCSID("$Id: prf.c 21129 2007-06-18 20:28:44Z lha $");
OM_uint32
_gsskrb5_pseudo_random(OM_uint32 *minor_status,
@@ -67,6 +67,7 @@ _gsskrb5_pseudo_random(OM_uint32 *minor_status,
switch(prf_key) {
case GSS_C_PRF_KEY_FULL:
_gsskrb5i_get_acceptor_subkey(ctx, context, &key);
+ break;
case GSS_C_PRF_KEY_PARTIAL:
_gsskrb5i_get_initiator_subkey(ctx, context, &key);
break;
diff --git a/source4/heimdal/lib/gssapi/krb5/release_name.c b/source4/heimdal/lib/gssapi/krb5/release_name.c
index a01a9a2a62..80b91930fd 100644
--- a/source4/heimdal/lib/gssapi/krb5/release_name.c
+++ b/source4/heimdal/lib/gssapi/krb5/release_name.c
@@ -33,7 +33,7 @@
#include "krb5/gsskrb5_locl.h"
-RCSID("$Id: release_name.c 19031 2006-11-13 18:02:57Z lha $");
+RCSID("$Id: release_name.c 21128 2007-06-18 20:26:50Z lha $");
OM_uint32 _gsskrb5_release_name
(OM_uint32 * minor_status,
@@ -43,8 +43,7 @@ OM_uint32 _gsskrb5_release_name
krb5_context context;
krb5_principal name = (krb5_principal)*input_name;
- if (minor_status)
- *minor_status = 0;
+ *minor_status = 0;
GSSAPI_KRB5_INIT (&context);
diff --git a/source4/heimdal/lib/gssapi/mech/context.c b/source4/heimdal/lib/gssapi/mech/context.c
index 1691fd9401..e4517bee44 100644
--- a/source4/heimdal/lib/gssapi/mech/context.c
+++ b/source4/heimdal/lib/gssapi/mech/context.c
@@ -1,7 +1,7 @@
#include "mech/mech_locl.h"
#include "heim_threads.h"
-RCSID("$Id: context.c 19924 2007-01-16 10:17:01Z lha $");
+RCSID("$Id: context.c 21248 2007-06-21 00:45:13Z lha $");
struct mg_thread_ctx {
gss_OID mech;
@@ -79,7 +79,7 @@ _gss_mg_get_error(const gss_OID mech, OM_uint32 type,
switch (type) {
case GSS_C_GSS_CODE: {
- if (value != mg->maj_stat)
+ if (value != mg->maj_stat || mg->maj_error.length == 0)
break;
string->value = malloc(mg->maj_error.length);
string->length = mg->maj_error.length;
@@ -87,7 +87,7 @@ _gss_mg_get_error(const gss_OID mech, OM_uint32 type,
return GSS_S_COMPLETE;
}
case GSS_C_MECH_CODE: {
- if (value != mg->min_stat)
+ if (value != mg->min_stat || mg->min_error.length == 0)
break;
string->value = malloc(mg->min_error.length);
string->length = mg->min_error.length;
diff --git a/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c b/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
index 8c5f4d0b08..d1e243d8b8 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_accept_sec_context.c
@@ -27,7 +27,7 @@
*/
#include "mech_locl.h"
-RCSID("$Id: gss_accept_sec_context.c 20626 2007-05-08 13:56:49Z lha $");
+RCSID("$Id: gss_accept_sec_context.c 21237 2007-06-20 11:21:09Z lha $");
static OM_uint32
parse_header(const gss_buffer_t input_token, gss_OID mech_oid)
@@ -237,9 +237,7 @@ OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
return (major_status);
}
- if (!src_name) {
- m->gm_release_name(minor_status, &src_mn);
- } else {
+ if (src_name && src_mn) {
/*
* Make a new name and mark it as an MN.
*/
@@ -250,13 +248,15 @@ OM_uint32 gss_accept_sec_context(OM_uint32 *minor_status,
return (GSS_S_FAILURE);
}
*src_name = (gss_name_t) name;
+ } else if (src_mn) {
+ m->gm_release_name(minor_status, &src_mn);
}
if (mech_ret_flags & GSS_C_DELEG_FLAG) {
if (!delegated_cred_handle) {
m->gm_release_cred(minor_status, &delegated_mc);
*ret_flags &= ~GSS_C_DELEG_FLAG;
- } else {
+ } else if (delegated_mc) {
struct _gss_cred *dcred;
struct _gss_mechanism_cred *dmc;
diff --git a/source4/heimdal/lib/gssapi/mech/gss_display_name.c b/source4/heimdal/lib/gssapi/mech/gss_display_name.c
index e57e5dd795..fc10933692 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_display_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_display_name.c
@@ -27,7 +27,7 @@
*/
#include "mech_locl.h"
-RCSID("$Id: gss_display_name.c 19952 2007-01-17 10:16:15Z lha $");
+RCSID("$Id: gss_display_name.c 21246 2007-06-20 15:25:19Z lha $");
OM_uint32
gss_display_name(OM_uint32 *minor_status,
@@ -43,6 +43,11 @@ gss_display_name(OM_uint32 *minor_status,
if (output_name_type)
*output_name_type = GSS_C_NO_OID;
+ if (name == NULL) {
+ *minor_status = 0;
+ return (GSS_S_BAD_NAME);
+ }
+
/*
* If we know it, copy the buffer used to import the name in
* the first place. Otherwise, ask all the MNs in turn if
diff --git a/source4/heimdal/lib/gssapi/mech/gss_display_status.c b/source4/heimdal/lib/gssapi/mech/gss_display_status.c
index c316c26fd7..37ded26db6 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_display_status.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_display_status.c
@@ -59,7 +59,7 @@
*/
#include "mech_locl.h"
-RCSID("$Id: gss_display_status.c 20084 2007-01-31 12:12:08Z lha $");
+RCSID("$Id: gss_display_status.c 21247 2007-06-21 00:37:27Z lha $");
static const char *
calling_error(OM_uint32 v)
@@ -85,7 +85,7 @@ static const char *
routine_error(OM_uint32 v)
{
static const char *msgs[] = {
- NULL, /* 0 */
+ "Function completed successfully", /* 0 */
"An unsupported mechanism was requested",
"An invalid name was supplied",
"A supplied name was of an unsupported type",
@@ -109,9 +109,7 @@ routine_error(OM_uint32 v)
v >>= GSS_C_ROUTINE_ERROR_OFFSET;
- if (v == 0)
- return "";
- else if (v >= sizeof(msgs)/sizeof(*msgs))
+ if (v >= sizeof(msgs)/sizeof(*msgs))
return "unknown routine error";
else
return msgs[v];
diff --git a/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c b/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
index 3aab0b9bbc..4ff81fdf2d 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_duplicate_name.c
@@ -27,7 +27,7 @@
*/
#include "mech_locl.h"
-RCSID("$Id: gss_duplicate_name.c 19953 2007-01-17 11:16:35Z lha $");
+RCSID("$Id: gss_duplicate_name.c 21219 2007-06-20 08:27:11Z lha $");
OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
const gss_name_t src_name,
@@ -44,7 +44,7 @@ OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
/*
* If this name has a value (i.e. it didn't come from
* gss_canonicalize_name(), we re-import the thing. Otherwise,
- * we make an empty name to hold the MN copy.
+ * we make copy of each mech names.
*/
if (name->gn_value.value) {
major_status = gss_import_name(minor_status,
@@ -52,6 +52,10 @@ OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
if (major_status != GSS_S_COMPLETE)
return (major_status);
new_name = (struct _gss_name *) *dest_name;
+
+ SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
+ _gss_find_mn(new_name, mn->gmn_mech_oid);
+ }
} else {
new_name = malloc(sizeof(struct _gss_name));
if (!new_name) {
@@ -59,17 +63,30 @@ OM_uint32 gss_duplicate_name(OM_uint32 *minor_status,
return (GSS_S_FAILURE);
}
memset(new_name, 0, sizeof(struct _gss_name));
- SLIST_INIT(&name->gn_mn);
+ SLIST_INIT(&new_name->gn_mn);
*dest_name = (gss_name_t) new_name;
- }
+
+ SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
+ struct _gss_mechanism_name *new_mn;
+
+ new_mn = malloc(sizeof(*new_mn));
+ if (!new_mn) {
+ *minor_status = ENOMEM;
+ return GSS_S_FAILURE;
+ }
+ new_mn->gmn_mech = mn->gmn_mech;
+ new_mn->gmn_mech_oid = mn->gmn_mech_oid;
+
+ major_status =
+ mn->gmn_mech->gm_duplicate_name(minor_status,
+ mn->gmn_name, &new_mn->gmn_name);
+ if (major_status != GSS_S_COMPLETE) {
+ free(new_mn);
+ continue;
+ }
+ SLIST_INSERT_HEAD(&new_name->gn_mn, new_mn, gmn_link);
+ }
- /*
- * Import the new name into any mechanisms listed in the
- * original name. We could probably get away with only doing
- * this if the original was canonical.
- */
- SLIST_FOREACH(mn, &name->gn_mn, gmn_link) {
- _gss_find_mn(new_name, mn->gmn_mech_oid);
}
return (GSS_S_COMPLETE);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_inquire_context.c b/source4/heimdal/lib/gssapi/mech/gss_inquire_context.c
index 5cce30c6bd..d45baac602 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_inquire_context.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_inquire_context.c
@@ -27,7 +27,7 @@
*/
#include "mech_locl.h"
-RCSID("$Id: gss_inquire_context.c 19958 2007-01-17 13:56:18Z lha $");
+RCSID("$Id: gss_inquire_context.c 21125 2007-06-18 20:11:07Z lha $");
OM_uint32
gss_inquire_context(OM_uint32 *minor_status,
@@ -79,7 +79,8 @@ gss_inquire_context(OM_uint32 *minor_status,
if (src_name) {
name = _gss_make_name(m, src_mn);
if (!name) {
- *mech_type = GSS_C_NO_OID;
+ if (mech_type)
+ *mech_type = GSS_C_NO_OID;
m->gm_release_name(minor_status, &src_mn);
*minor_status = 0;
return (GSS_S_FAILURE);
@@ -90,8 +91,10 @@ gss_inquire_context(OM_uint32 *minor_status,
if (targ_name) {
name = _gss_make_name(m, targ_mn);
if (!name) {
- *mech_type = GSS_C_NO_OID;
- gss_release_name(minor_status, src_name);
+ if (mech_type)
+ *mech_type = GSS_C_NO_OID;
+ if (src_name)
+ gss_release_name(minor_status, src_name);
m->gm_release_name(minor_status, &targ_mn);
*minor_status = 0;
return (GSS_S_FAILURE);
diff --git a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
index a4ace9e9e9..aa83efb0c2 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_inquire_cred_by_mech.c
@@ -27,7 +27,7 @@
*/
#include "mech_locl.h"
-RCSID("$Id: gss_inquire_cred_by_mech.c 19960 2007-01-17 15:09:24Z lha $");
+RCSID("$Id: gss_inquire_cred_by_mech.c 21124 2007-06-18 20:08:24Z lha $");
OM_uint32
gss_inquire_cred_by_mech(OM_uint32 *minor_status,
@@ -78,12 +78,16 @@ gss_inquire_cred_by_mech(OM_uint32 *minor_status,
return (major_status);
}
- name = _gss_make_name(m, mn);
- if (!name) {
+ if (cred_name) {
+ name = _gss_make_name(m, mn);
+ if (!name) {
m->gm_release_name(minor_status, &mn);
return (GSS_S_NO_CRED);
- }
+ }
+ *cred_name = (gss_name_t) name;
+ } else
+ m->gm_release_name(minor_status, &mn);
+
- *cred_name = (gss_name_t) name;
return (GSS_S_COMPLETE);
}
diff --git a/source4/heimdal/lib/gssapi/mech/gss_krb5.c b/source4/heimdal/lib/gssapi/mech/gss_krb5.c
index 2500928baf..9e77f42982 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_krb5.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_krb5.c
@@ -27,7 +27,7 @@
*/
#include "mech_locl.h"
-RCSID("$Id: gss_krb5.c 20383 2007-04-18 08:49:53Z lha $");
+RCSID("$Id: gss_krb5.c 21123 2007-06-18 20:05:26Z lha $");
#include <krb5.h>
#include <roken.h>
@@ -650,7 +650,7 @@ gsskrb5_extract_authz_data_from_sec_context(OM_uint32 *minor_status,
if (der_put_oid((unsigned char *)oid_flat.elements + oid_flat.length - 1,
oid_flat.length, &oid, &size) != 0) {
free(oid.components);
-
+ free(oid_flat.elements);
*minor_status = EINVAL;
return GSS_S_FAILURE;
}
diff --git a/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c b/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
index 78c8cc79c1..c32291396f 100644
--- a/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
+++ b/source4/heimdal/lib/gssapi/mech/gss_set_cred_option.c
@@ -31,7 +31,7 @@
*/
#include "mech_locl.h"
-RCSID("$Id: gss_set_cred_option.c 20626 2007-05-08 13:56:49Z lha $");
+RCSID("$Id: gss_set_cred_option.c 21126 2007-06-18 20:19:59Z lha $");
OM_uint32
gss_set_cred_option (OM_uint32 *minor_status,
@@ -64,7 +64,9 @@ gss_set_cred_option (OM_uint32 *minor_status,
mc = malloc(sizeof(*mc));
if (mc == NULL) {
- /* XXX free the other mc's */
+ *cred_handle = (gss_cred_id_t)cred;
+ gss_release_cred(minor_status, cred_handle);
+ *minor_status = ENOMEM;
return GSS_S_FAILURE;
}
diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index 106897b9b0..d20c913bf0 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -33,7 +33,7 @@
#include "spnego/spnego_locl.h"
-RCSID("$Id: accept_sec_context.c 20929 2007-06-05 21:19:22Z lha $");
+RCSID("$Id: accept_sec_context.c 21243 2007-06-20 15:16:22Z lha $");
static OM_uint32
send_reject (OM_uint32 *minor_status,
@@ -540,12 +540,12 @@ acceptor_start
gss_cred_id_t *delegated_cred_handle
)
{
- OM_uint32 ret, ret2, minor;
- NegTokenInit ni;
- size_t ni_len;
+ OM_uint32 ret, junk, minor;
+ NegotiationToken nt;
+ size_t nt_len;
+ NegTokenInit *ni;
int i;
gss_buffer_desc data;
- size_t len, taglen;
gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
gss_buffer_desc mech_output_token;
gss_buffer_desc mech_buf;
@@ -555,6 +555,9 @@ acceptor_start
int get_mic = 0;
int first_ok = 0;
+ if (src_name)
+ *src_name = GSS_C_NO_NAME;
+
mech_output_token.value = NULL;
mech_output_token.length = 0;
mech_buf.value = NULL;
@@ -582,39 +585,30 @@ acceptor_start
if (ret)
return ret;
- ret = der_match_tag_and_length(data.value, data.length,
- ASN1_C_CONTEXT, CONS,
- 0,
- &len, &taglen);
+ ret = decode_NegotiationToken(data.value, data.length, &nt, &nt_len);
+ gss_release_buffer(minor_status, &data);
if (ret) {
*minor_status = ret;
- return GSS_S_FAILURE;
- }
-
- if (len > data.length - taglen) {
- *minor_status = ASN1_OVERRUN;
- return GSS_S_FAILURE;
+ return GSS_S_DEFECTIVE_TOKEN;
}
-
- ret = decode_NegTokenInit((const unsigned char *)data.value + taglen,
- len, &ni, &ni_len);
- if (ret) {
- *minor_status = ret;
+ if (nt.element != choice_NegotiationToken_negTokenInit) {
+ *minor_status = 0;
return GSS_S_DEFECTIVE_TOKEN;
}
+ ni = &nt.u.negTokenInit;
- if (ni.mechTypes.len < 1) {
- free_NegTokenInit(&ni);
+ if (ni->mechTypes.len < 1) {
+ free_NegotiationToken(&nt);
*minor_status = 0;
return GSS_S_DEFECTIVE_TOKEN;
}
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
- ret = copy_MechTypeList(&ni.mechTypes, &ctx->initiator_mech_types);
+ ret = copy_MechTypeList(&ni->mechTypes, &ctx->initiator_mech_types);
if (ret) {
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
- free_NegTokenInit(&ni);
+ free_NegotiationToken(&nt);
*minor_status = ret;
return GSS_S_FAILURE;
}
@@ -627,17 +621,17 @@ acceptor_start
*/
ret = select_mech(minor_status,
- &ni.mechTypes.val[0],
+ &ni->mechTypes.val[0],
0,
&preferred_mech_type);
- if (ret == 0 && ni.mechToken != NULL) {
+ if (ret == 0 && ni->mechToken != NULL) {
gss_cred_id_t mech_delegated_cred = GSS_C_NO_CREDENTIAL;
gss_cred_id_t mech_cred;
gss_buffer_desc ibuf;
- ibuf.length = ni.mechToken->length;
- ibuf.value = ni.mechToken->data;
+ ibuf.length = ni->mechToken->length;
+ ibuf.value = ni->mechToken->data;
mech_input_token = &ibuf;
if (acceptor_cred != NULL)
@@ -668,12 +662,12 @@ acceptor_start
if (ret == GSS_S_COMPLETE)
ctx->open = 1;
- if (delegated_cred_handle)
+ if (mech_delegated_cred && delegated_cred_handle)
ret = _gss_spnego_alloc_cred(minor_status,
mech_delegated_cred,
delegated_cred_handle);
else
- gss_release_cred(&ret2, &mech_delegated_cred);
+ gss_release_cred(&junk, &mech_delegated_cred);
ret = acceptor_complete(minor_status,
ctx,
@@ -681,7 +675,7 @@ acceptor_start
&mech_buf,
mech_input_token,
&mech_output_token,
- ni.mechListMIC,
+ ni->mechListMIC,
output_token);
if (ret != GSS_S_COMPLETE)
goto out;
@@ -697,9 +691,9 @@ acceptor_start
if (!first_ok) {
/* Call glue layer to find first mech we support */
- for (i = 1; i < ni.mechTypes.len; ++i) {
+ for (i = 1; i < ni->mechTypes.len; ++i) {
ret = select_mech(minor_status,
- &ni.mechTypes.val[i],
+ &ni->mechTypes.val[i],
1,
&preferred_mech_type);
if (ret == 0)
@@ -707,7 +701,7 @@ acceptor_start
}
if (preferred_mech_type == GSS_C_NO_OID) {
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
- free_NegTokenInit(&ni);
+ free_NegotiationToken(&nt);
return GSS_S_BAD_MECH;
}
@@ -735,7 +729,8 @@ out:
free(mech_buf.value);
mech_buf.value = NULL;
}
- free_NegTokenInit(&ni);
+ free_NegotiationToken(&nt);
+
if (ret == GSS_S_COMPLETE) {
if (src_name != NULL && ctx->mech_src_name != NULL) {
@@ -746,8 +741,7 @@ out:
name->mech = ctx->mech_src_name;
ctx->mech_src_name = NULL;
*src_name = (gss_name_t)name;
- } else
- *src_name = GSS_C_NO_NAME;
+ }
}
if (delegated_cred_handle != NULL) {
*delegated_cred_handle = ctx->delegated_cred_id;
@@ -790,10 +784,9 @@ acceptor_continue
)
{
OM_uint32 ret, ret2, minor;
- NegTokenResp na;
- size_t na_len;
- gss_buffer_desc data;
- size_t len, taglen;
+ NegotiationToken nt;
+ size_t nt_len;
+ NegTokenResp *na;
unsigned int negResult = accept_incomplete;
gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
gss_buffer_t mech_output_token = GSS_C_NO_BUFFER;
@@ -810,45 +803,34 @@ acceptor_continue
* context token (negTokenInit).
*/
- data.value = input_token_buffer->value;
- data.length = input_token_buffer->length;
-
- ret = der_match_tag_and_length(data.value, data.length,
- ASN1_C_CONTEXT, CONS,
- 1,
- &len, &taglen);
+ ret = decode_NegotiationToken(input_token_buffer->value,
+ input_token_buffer->length,
+ &nt, &nt_len);
if (ret) {
*minor_status = ret;
- return GSS_S_FAILURE;
- }
-
- if (len > data.length - taglen) {
- *minor_status = ASN1_OVERRUN;
- return GSS_S_FAILURE;
+ return GSS_S_DEFECTIVE_TOKEN;
}
-
- ret = decode_NegTokenResp((const unsigned char *)data.value + taglen,
- len, &na, &na_len);
- if (ret) {
- *minor_status = ret;
+ if (nt.element != choice_NegotiationToken_negTokenResp) {
+ *minor_status = 0;
return GSS_S_DEFECTIVE_TOKEN;
}
+ na = &nt.u.negTokenResp;
- if (na.negResult != NULL) {
- negResult = *(na.negResult);
+ if (na->negResult != NULL) {
+ negResult = *(na->negResult);
}
HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
{
gss_buffer_desc ibuf, obuf;
- int require_mic, get_mic;
+ int require_mic, get_mic = 0;
int require_response;
heim_octet_string *mic;
- if (na.responseToken != NULL) {
- ibuf.length = na.responseToken->length;
- ibuf.value = na.responseToken->data;
+ if (na->responseToken != NULL) {
+ ibuf.length = na->responseToken->length;
+ ibuf.value = na->responseToken->data;
mech_input_token = &ibuf;
} else {
ibuf.value = NULL;
@@ -901,7 +883,7 @@ acceptor_continue
mech_output_token = &obuf;
}
if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
- free_NegTokenResp(&na);
+ free_NegotiationToken(&nt);
send_reject (minor_status, output_token);
HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
return ret;
@@ -919,7 +901,7 @@ acceptor_continue
ctx->require_mic = require_mic;
- mic = na.mechListMIC;
+ mic = na->mechListMIC;
if (mic != NULL)
require_mic = 1;
@@ -930,7 +912,7 @@ acceptor_continue
&mech_buf,
mech_input_token,
mech_output_token,
- na.mechListMIC,
+ na->mechListMIC,
output_token);
if (ctx->mech_flags & GSS_C_DCE_STYLE)
@@ -964,16 +946,19 @@ acceptor_continue
gss_release_buffer(&minor, mech_output_token);
if (mech_buf.value != NULL)
free(mech_buf.value);
- free_NegTokenResp(&na);
+ free_NegotiationToken(&nt);
}
if (ret == GSS_S_COMPLETE) {
- if (src_name != NULL) {
- ret2 = gss_duplicate_name(minor_status,
- ctx->mech_src_name,
- src_name);
- if (ret2 != GSS_S_COMPLETE)
- ret = ret2;
+ if (src_name != NULL && ctx->mech_src_name != NULL) {
+ spnego_name name;
+
+ name = calloc(1, sizeof(*name));
+ if (name) {
+ name->mech = ctx->mech_src_name;
+ ctx->mech_src_name = NULL;
+ *src_name = (gss_name_t)name;
+ }
}
if (delegated_cred_handle != NULL) {
*delegated_cred_handle = ctx->delegated_cred_id;
generated by cgit (git 2.34.1) at 2024-07-28 17:41:38 +0000