From 3c1e780ec7e16dc6667402bbc65708bf9a5c062f Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 7 Nov 2006 06:59:56 +0000
Subject: r19604: This is a massive commit, and I appologise in advance for
 it's size.

This merges Samba4 with lorikeet-heimdal, which itself has been
tracking Heimdal CVS for the past couple of weeks.

This is such a big change because Heimdal reorganised it's internal
structures, with the mechglue merge, and because many of our 'wishes' have been granted:  we now have DCE_STYLE GSSAPI, send_to_kdc hooks and many other features merged into the mainline code.  We have adapted to upstream's choice of API in these cases.

In gensec_gssapi and gensec_krb5, we either expect a valid PAC, or NO
PAC.  This matches windows behavour.  We also have an option to
require the PAC to be present (which allows us to automate the testing
of this code).

This also includes a restructure of how the kerberos dependencies are
handled, due to the fallout of the merge.

Andrew Bartlett
(This used to be commit 4826f1735197c2a471d771495e6d4c1051b4c471)
---
 .../heimdal/lib/gssapi/spnego/accept_sec_context.c | 873 +++++++++++++++++++++
 1 file changed, 873 insertions(+)
 create mode 100644 source4/heimdal/lib/gssapi/spnego/accept_sec_context.c

(limited to 'source4/heimdal/lib/gssapi/spnego/accept_sec_context.c')

diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
new file mode 100644
index 0000000000..8a885a3e2f
--- /dev/null
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -0,0 +1,873 @@
+/*
+ * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * Portions Copyright (c) 2004 PADL Software Pty Ltd.
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors 
+ *    may be used to endorse or promote products derived from this software 
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+ * SUCH DAMAGE. 
+ */
+
+#include "spnego/spnego_locl.h"
+
+RCSID("$Id: accept_sec_context.c,v 1.6 2006/10/07 22:26:57 lha Exp $");
+
+OM_uint32
+_gss_spnego_encode_response(OM_uint32 *minor_status,
+			    const NegTokenResp *resp,
+			    gss_buffer_t data,
+			    u_char **ret_buf)
+{
+    OM_uint32 ret;
+    u_char *buf;
+    size_t buf_size, buf_len;
+
+    buf_size = 1024;
+    buf = malloc(buf_size);
+    if (buf == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+
+    do {
+	ret = encode_NegTokenResp(buf + buf_size - 1,
+				  buf_size,
+				  resp, &buf_len);
+	if (ret == 0) {
+	    size_t tmp;
+
+	    ret = der_put_length_and_tag(buf + buf_size - buf_len - 1,
+					 buf_size - buf_len,
+					 buf_len,
+					 ASN1_C_CONTEXT,
+					 CONS,
+					 1,
+					 &tmp);
+	    if (ret == 0)
+		buf_len += tmp;
+	}
+	if (ret) {
+	    if (ret == ASN1_OVERFLOW) {
+		u_char *tmp;
+
+		buf_size *= 2;
+		tmp = realloc (buf, buf_size);
+		if (tmp == NULL) {
+		    *minor_status = ENOMEM;
+		    free(buf);
+		    return GSS_S_FAILURE;
+		}
+		buf = tmp;
+	    } else {
+		*minor_status = ret;
+		free(buf);
+		return GSS_S_FAILURE;
+	    }
+	}
+    } while (ret == ASN1_OVERFLOW);
+
+    data->value  = buf + buf_size - buf_len;
+    data->length = buf_len;
+    *ret_buf     = buf;
+
+    return GSS_S_COMPLETE;
+}
+
+static OM_uint32
+send_reject (OM_uint32 *minor_status,
+	     gss_buffer_t output_token)
+{
+    NegTokenResp resp;
+    gss_buffer_desc data;
+    u_char *buf;
+    OM_uint32 ret;
+
+    ALLOC(resp.negResult, 1);
+    if (resp.negResult == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+    *(resp.negResult)  = reject;
+    resp.supportedMech = NULL;
+    resp.responseToken = NULL;
+    resp.mechListMIC   = NULL;
+    
+    ret = _gss_spnego_encode_response (minor_status, &resp, &data, &buf);
+    free_NegTokenResp(&resp);
+    if (ret != GSS_S_COMPLETE)
+	return ret;
+
+    output_token->value = malloc(data.length);
+    if (output_token->value == NULL) {
+	*minor_status = ENOMEM;
+	ret = GSS_S_FAILURE;
+    } else {
+	output_token->length = data.length;
+	memcpy(output_token->value, data.value, output_token->length);
+    }
+    free(buf);
+    if (ret != GSS_S_COMPLETE)
+	return ret;
+    return GSS_S_BAD_MECH;
+}
+
+OM_uint32
+_gss_spnego_indicate_mechtypelist (OM_uint32 *minor_status,
+				   int includeMSCompatOID,
+				   const gssspnego_cred cred_handle,
+				   MechTypeList *mechtypelist,
+				   gss_OID *preferred_mech)
+{
+    OM_uint32 ret;
+    gss_OID_set supported_mechs = GSS_C_NO_OID_SET;
+    int i, count;
+
+    if (cred_handle != NULL) {
+	ret = gss_inquire_cred(minor_status,
+			       cred_handle->negotiated_cred_id,
+			       NULL,
+			       NULL,
+			       NULL,
+			       &supported_mechs);
+    } else {
+	ret = gss_indicate_mechs(minor_status, &supported_mechs);
+    }
+
+    if (ret != GSS_S_COMPLETE) {
+	return ret;
+    }
+
+    if (supported_mechs->count == 0) {
+	*minor_status = ENOENT;
+	gss_release_oid_set(minor_status, &supported_mechs);
+	return GSS_S_FAILURE;
+    }
+
+    count = supported_mechs->count;
+    if (includeMSCompatOID)
+	count++;
+
+    mechtypelist->len = 0;
+    mechtypelist->val = calloc(count, sizeof(MechType));
+    if (mechtypelist->val == NULL) {
+	*minor_status = ENOMEM;
+	gss_release_oid_set(minor_status, &supported_mechs);
+	return GSS_S_FAILURE;
+    }
+
+    for (i = 0; i < supported_mechs->count; i++) {
+	ret = _gss_spnego_add_mech_type(&supported_mechs->elements[i],
+					includeMSCompatOID,
+					mechtypelist);
+	if (ret != 0) {
+	    *minor_status = ENOMEM;
+	    ret = GSS_S_FAILURE;
+	    break;
+	}
+    }
+
+    if (ret == GSS_S_COMPLETE && preferred_mech != NULL) {
+	ret = gss_duplicate_oid(minor_status,
+				&supported_mechs->elements[0],
+				preferred_mech);
+    }
+
+    if (ret != GSS_S_COMPLETE) {
+	free_MechTypeList(mechtypelist);
+	mechtypelist->len = 0;
+	mechtypelist->val = NULL;
+    }
+    gss_release_oid_set(minor_status, &supported_mechs);
+
+    return ret;
+}
+
+static OM_uint32
+send_supported_mechs (OM_uint32 *minor_status,
+		      gss_buffer_t output_token)
+{
+    NegTokenInit ni;
+    char hostname[MAXHOSTNAMELEN], *p;
+    gss_buffer_desc name_buf;
+    gss_OID name_type;
+    gss_name_t target_princ;
+    gss_name_t canon_princ;
+    OM_uint32 ret, minor;
+    u_char *buf;
+    size_t buf_size, buf_len;
+    gss_buffer_desc data;
+
+    memset(&ni, 0, sizeof(ni));
+
+    ni.reqFlags = NULL;
+    ni.mechToken = NULL;
+    ni.negHints = NULL;
+    ni.mechListMIC = NULL;
+
+    ret = _gss_spnego_indicate_mechtypelist(minor_status, 1,
+					    NULL,
+					    &ni.mechTypes, NULL);
+    if (ret != GSS_S_COMPLETE) {
+	return ret;
+    }
+
+    memset(&target_princ, 0, sizeof(target_princ));
+    if (gethostname(hostname, sizeof(hostname) - 1) != 0) {
+	*minor_status = errno;
+	free_NegTokenInit(&ni);
+	return GSS_S_FAILURE;
+    }
+
+    /* Send the constructed SAM name for this host */
+    for (p = hostname; *p != '\0' && *p != '.'; p++) {
+	*p = toupper((unsigned char)*p);
+    }
+    *p++ = '$';
+    *p = '\0';
+
+    name_buf.length = strlen(hostname);
+    name_buf.value = hostname;
+
+    ret = gss_import_name(minor_status, &name_buf,
+			  GSS_C_NO_OID,
+			  &target_princ);
+    if (ret != GSS_S_COMPLETE) {
+	return ret;
+    }
+
+    name_buf.length = 0;
+    name_buf.value = NULL;
+
+    /* Canonicalize the name using the preferred mechanism */
+    ret = gss_canonicalize_name(minor_status,
+				target_princ,
+				GSS_C_NO_OID,
+				&canon_princ);
+    if (ret != GSS_S_COMPLETE) {
+	gss_release_name(&minor, &target_princ);
+	return ret;
+    }
+
+    ret = gss_display_name(minor_status, canon_princ,
+			   &name_buf, &name_type);
+    if (ret != GSS_S_COMPLETE) {
+	gss_release_name(&minor, &canon_princ);
+	gss_release_name(&minor, &target_princ);
+	return ret;
+    }
+
+    gss_release_name(&minor, &canon_princ);
+    gss_release_name(&minor, &target_princ);
+
+    ALLOC(ni.negHints, 1);
+    if (ni.negHints == NULL) {
+	*minor_status = ENOMEM;
+	gss_release_buffer(&minor, &name_buf);
+	free_NegTokenInit(&ni);
+	return GSS_S_FAILURE;
+    }
+
+    ALLOC(ni.negHints->hintName, 1);
+    if (ni.negHints->hintName == NULL) {
+	*minor_status = ENOMEM;
+	gss_release_buffer(&minor, &name_buf);
+	free_NegTokenInit(&ni);
+	return GSS_S_FAILURE;
+    }
+
+    *(ni.negHints->hintName) = name_buf.value;
+    name_buf.value = NULL;
+    ni.negHints->hintAddress = NULL;
+
+    buf_size = 1024;
+    buf = malloc(buf_size);
+    if (buf == NULL) {
+	free_NegTokenInit(&ni);
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+
+    do {
+	ret = encode_NegTokenInit(buf + buf_size - 1,
+				  buf_size,
+				  &ni, &buf_len);
+	if (ret == 0) {
+	    size_t tmp;
+
+	    ret = der_put_length_and_tag(buf + buf_size - buf_len - 1,
+					 buf_size - buf_len,
+					 buf_len,
+					 ASN1_C_CONTEXT,
+					 CONS,
+					 0,
+					 &tmp);
+	    if (ret == 0)
+		buf_len += tmp;
+	}
+	if (ret) {
+	    if (ret == ASN1_OVERFLOW) {
+		u_char *tmp;
+
+		buf_size *= 2;
+		tmp = realloc (buf, buf_size);
+		if (tmp == NULL) {
+		    *minor_status = ENOMEM;
+		    free(buf);
+		    free_NegTokenInit(&ni);
+		    return GSS_S_FAILURE;
+		}
+		buf = tmp;
+	    } else {
+		*minor_status = ret;
+		free(buf);
+		free_NegTokenInit(&ni);
+		return GSS_S_FAILURE;
+	    }
+	}
+    } while (ret == ASN1_OVERFLOW);
+
+    data.value  = buf + buf_size - buf_len;
+    data.length = buf_len;
+
+    ret = gss_encapsulate_token(&data,
+				GSS_SPNEGO_MECHANISM,
+				output_token);
+    free (buf);
+    free_NegTokenInit (&ni);
+
+    if (ret != GSS_S_COMPLETE)
+	return ret;
+
+    *minor_status = 0;
+
+    return GSS_S_CONTINUE_NEEDED;
+}
+
+static OM_uint32
+send_accept (OM_uint32 *minor_status,
+	     gssspnego_ctx context_handle,
+	     gss_buffer_t mech_token,
+	     int initial_response,
+	     gss_buffer_t mech_buf,
+	     gss_buffer_t output_token)
+{
+    NegTokenResp resp;
+    gss_buffer_desc data;
+    u_char *buf;
+    OM_uint32 ret;
+    gss_buffer_desc mech_mic_buf;
+
+    memset(&resp, 0, sizeof(resp));
+
+    ALLOC(resp.negResult, 1);
+    if (resp.negResult == NULL) {
+	*minor_status = ENOMEM;
+	return GSS_S_FAILURE;
+    }
+
+    if (context_handle->open) {
+	if (mech_token != GSS_C_NO_BUFFER
+	    && mech_token->length != 0
+	    && mech_buf != GSS_C_NO_BUFFER)
+	    *(resp.negResult) = accept_incomplete;
+	else
+	    *(resp.negResult) = accept_completed;
+    } else {
+	if (initial_response && context_handle->require_mic)
+	    *(resp.negResult) = request_mic;
+	else
+	    *(resp.negResult) = accept_incomplete;
+    }
+
+    if (initial_response) {
+	ALLOC(resp.supportedMech, 1);
+	if (resp.supportedMech == NULL) {
+	    free_NegTokenResp(&resp);
+	    *minor_status = ENOMEM;
+	    return GSS_S_FAILURE;
+	}
+
+	ret = der_get_oid(context_handle->preferred_mech_type->elements,
+			  context_handle->preferred_mech_type->length,
+			  resp.supportedMech,
+			  NULL);
+	if (ret) {
+	    free_NegTokenResp(&resp);
+	    *minor_status = ENOMEM;
+	    return GSS_S_FAILURE;
+	}
+    } else {
+	resp.supportedMech = NULL;
+    }
+
+    if (mech_token != GSS_C_NO_BUFFER && mech_token->length != 0) {
+	ALLOC(resp.responseToken, 1);
+	if (resp.responseToken == NULL) {
+	    free_NegTokenResp(&resp);
+	    *minor_status = ENOMEM;
+	    return GSS_S_FAILURE;
+	}
+	resp.responseToken->length = mech_token->length;
+	resp.responseToken->data   = mech_token->value;
+	mech_token->length = 0;
+	mech_token->value  = NULL;
+    } else {
+	resp.responseToken = NULL;
+    }
+
+    if (mech_buf != GSS_C_NO_BUFFER) {
+	ALLOC(resp.mechListMIC, 1);
+	if (resp.mechListMIC == NULL) {
+	    free_NegTokenResp(&resp);
+	    *minor_status = ENOMEM;
+	    return GSS_S_FAILURE;
+	}
+
+	ret = gss_get_mic(minor_status,
+			  context_handle->negotiated_ctx_id,
+			  0,
+			  mech_buf,
+			  &mech_mic_buf);
+	if (ret != GSS_S_COMPLETE) {
+	    free_NegTokenResp(&resp);
+	    return ret;
+	}
+
+	resp.mechListMIC->length = mech_mic_buf.length;
+	resp.mechListMIC->data   = mech_mic_buf.value;
+    } else
+	resp.mechListMIC = NULL;
+ 
+    ret = _gss_spnego_encode_response (minor_status, &resp, &data, &buf);
+    if (ret != GSS_S_COMPLETE) {
+	free_NegTokenResp(&resp);
+	return ret;
+    }
+
+    /*
+     * The response should not be encapsulated, because
+     * it is a SubsequentContextToken (note though RFC 1964
+     * specifies encapsulation for all _Kerberos_ tokens).
+     */
+    output_token->value = malloc(data.length);
+    if (output_token->value == NULL) {
+	*minor_status = ENOMEM;
+	ret = GSS_S_FAILURE;
+    } else {
+	output_token->length = data.length;
+	memcpy(output_token->value, data.value, output_token->length);
+    }
+    free(buf);
+    if (ret != GSS_S_COMPLETE) {
+	free_NegTokenResp(&resp);
+	return ret;
+    }
+
+    ret = (*(resp.negResult) == accept_completed) ? GSS_S_COMPLETE :
+						    GSS_S_CONTINUE_NEEDED;
+    free_NegTokenResp(&resp);
+    return ret;
+}
+
+
+static OM_uint32
+verify_mechlist_mic
+	   (OM_uint32 *minor_status,
+	    gssspnego_ctx context_handle,
+	    gss_buffer_t mech_buf,
+	    heim_octet_string *mechListMIC
+	   )
+{
+    OM_uint32 ret;
+    gss_buffer_desc mic_buf;
+
+    if (context_handle->verified_mic) {
+	/* This doesn't make sense, we've already verified it? */
+	*minor_status = 0;
+	return GSS_S_DUPLICATE_TOKEN;
+    }
+
+    if (mechListMIC == NULL) {
+	*minor_status = 0;
+	return GSS_S_DEFECTIVE_TOKEN;
+    }
+
+    mic_buf.length = mechListMIC->length;
+    mic_buf.value  = mechListMIC->data;
+
+    ret = gss_verify_mic(minor_status,
+			 context_handle->negotiated_ctx_id,
+			 mech_buf,
+			 &mic_buf,
+			 NULL);
+
+    if (ret != GSS_S_COMPLETE)
+	ret = GSS_S_DEFECTIVE_TOKEN;
+
+    return ret;
+}
+
+OM_uint32
+_gss_spnego_accept_sec_context
+	   (OM_uint32 * minor_status,
+	    gss_ctx_id_t * context_handle,
+	    const gss_cred_id_t acceptor_cred_handle,
+	    const gss_buffer_t input_token_buffer,
+	    const gss_channel_bindings_t input_chan_bindings,
+	    gss_name_t * src_name,
+	    gss_OID * mech_type,
+	    gss_buffer_t output_token,
+	    OM_uint32 * ret_flags,
+	    OM_uint32 * time_rec,
+	    gss_cred_id_t *delegated_cred_handle
+	   )
+{
+    OM_uint32 ret, ret2, minor;
+    NegTokenInit ni;
+    NegTokenResp na;
+    size_t ni_len, na_len;
+    int i;
+    gss_buffer_desc data;
+    size_t len, taglen;
+    int initialToken;
+    unsigned int negResult = accept_incomplete;
+    gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
+    gss_buffer_t mech_output_token = GSS_C_NO_BUFFER;
+    gss_buffer_desc mech_buf;
+    gss_OID preferred_mech_type = GSS_C_NO_OID;
+    gssspnego_ctx ctx;
+    gssspnego_cred acceptor_cred = (gssspnego_cred)acceptor_cred_handle;
+
+    *minor_status = 0;
+
+    output_token->length = 0;
+    output_token->value  = NULL;
+
+    if (src_name != NULL)
+	*src_name = GSS_C_NO_NAME;
+
+    if (mech_type != NULL)
+	*mech_type = GSS_C_NO_OID;
+
+    if (ret_flags != NULL)
+	*ret_flags = 0;
+
+    if (time_rec != NULL)
+	*time_rec = 0;
+
+    if (delegated_cred_handle != NULL)
+	*delegated_cred_handle = GSS_C_NO_CREDENTIAL;
+
+    mech_buf.value = NULL;
+
+    if (*context_handle == GSS_C_NO_CONTEXT) {
+	ret = _gss_spnego_alloc_sec_context(minor_status,
+					    context_handle);
+	if (ret != GSS_S_COMPLETE)
+	    return ret;
+
+	if (input_token_buffer->length == 0) {
+	    return send_supported_mechs (minor_status,
+					 output_token);
+	}
+    }
+
+    ctx = (gssspnego_ctx)*context_handle;
+
+    /*
+     * The GSS-API encapsulation is only present on the initial
+     * context token (negTokenInit).
+     */
+    ret = gss_decapsulate_token (input_token_buffer,
+				 GSS_SPNEGO_MECHANISM,
+				 &data);
+    initialToken = (ret == GSS_S_COMPLETE);
+
+    if (!initialToken) {
+	data.value  = input_token_buffer->value;
+	data.length = input_token_buffer->length;
+    }
+
+    ret = der_match_tag_and_length(data.value, data.length,
+				   ASN1_C_CONTEXT, CONS,
+				   initialToken ? 0 : 1,
+				   &len, &taglen);
+    if (ret) {
+	*minor_status = ret;
+	return GSS_S_FAILURE;
+    }
+
+    if (len > data.length - taglen) {
+	*minor_status = ASN1_OVERRUN;
+	return GSS_S_FAILURE;
+    }
+
+    if (initialToken) {
+	ret = decode_NegTokenInit((const unsigned char *)data.value + taglen, 
+				  len, &ni, &ni_len);
+    } else {
+	ret = decode_NegTokenResp((const unsigned char *)data.value + taglen, 
+				  len, &na, &na_len);
+    }
+    if (ret) {
+	*minor_status = ret;
+	return GSS_S_DEFECTIVE_TOKEN;
+    }
+
+    if (!initialToken && na.negResult != NULL) {
+	negResult = *(na.negResult);
+    }
+
+    if (negResult == reject || negResult == request_mic) {
+	/* request_mic should only be sent by acceptor */
+	free_NegTokenResp(&na);
+	return GSS_S_DEFECTIVE_TOKEN;
+    }
+
+    if (initialToken) {
+	for (i = 0; i < ni.mechTypes.len; ++i) {
+	    /* Call glue layer to find first mech we support */
+	    ret = _gss_spnego_select_mech(minor_status, &ni.mechTypes.val[i],
+					  &preferred_mech_type);
+	    if (ret == 0)
+		break;
+	}
+	if (preferred_mech_type == GSS_C_NO_OID) {
+	    free_NegTokenInit(&ni);
+	    return GSS_S_BAD_MECH;
+	}
+    }
+
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+
+    if (initialToken) {
+	ctx->preferred_mech_type = preferred_mech_type;
+	ctx->initiator_mech_types.len = ni.mechTypes.len;
+	ctx->initiator_mech_types.val = ni.mechTypes.val;
+	ni.mechTypes.len = 0;
+	ni.mechTypes.val = NULL;
+    }
+
+    {
+	gss_buffer_desc ibuf, obuf;
+	int require_mic, verify_mic, get_mic;
+	int require_response;
+	heim_octet_string *mic;
+
+	if (initialToken) {
+	    if (ni.mechToken != NULL) {
+		ibuf.length = ni.mechToken->length;
+		ibuf.value = ni.mechToken->data;
+		mech_input_token = &ibuf;
+	    }
+	} else {
+	    if (na.responseToken != NULL) {
+		ibuf.length = na.responseToken->length;
+		ibuf.value = na.responseToken->data;
+		mech_input_token = &ibuf;
+	    }
+	}
+
+	if (mech_input_token != GSS_C_NO_BUFFER) {
+	    gss_cred_id_t mech_cred;
+	    gss_cred_id_t mech_delegated_cred;
+	    gss_cred_id_t *mech_delegated_cred_p;
+
+	    if (acceptor_cred != NULL)
+		mech_cred = acceptor_cred->negotiated_cred_id;
+	    else
+		mech_cred = GSS_C_NO_CREDENTIAL;
+
+	    if (delegated_cred_handle != NULL) {
+		mech_delegated_cred = GSS_C_NO_CREDENTIAL;
+		mech_delegated_cred_p = &mech_delegated_cred;
+	    } else {
+		mech_delegated_cred_p = NULL;
+	    }
+
+	    if (ctx->mech_src_name != GSS_C_NO_NAME)
+		gss_release_name(&minor, &ctx->mech_src_name);
+
+	    if (ctx->delegated_cred_id != GSS_C_NO_CREDENTIAL)
+		_gss_spnego_release_cred(&minor, &ctx->delegated_cred_id);
+
+	    ret = gss_accept_sec_context(&minor,
+					 &ctx->negotiated_ctx_id,
+					 mech_cred,
+					 mech_input_token,
+					 input_chan_bindings,
+					 &ctx->mech_src_name,
+					 &ctx->negotiated_mech_type,
+					 &obuf,
+					 &ctx->mech_flags,
+					 &ctx->mech_time_rec,
+					 mech_delegated_cred_p);
+	    if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
+		if (mech_delegated_cred_p != NULL &&
+		    mech_delegated_cred != GSS_C_NO_CREDENTIAL) {
+		    ret2 = _gss_spnego_alloc_cred(minor_status,
+						  mech_delegated_cred,
+						  &ctx->delegated_cred_id);
+		    if (ret2 != GSS_S_COMPLETE)
+			ret = ret2;
+		}
+		mech_output_token = &obuf;
+	    }
+	    if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
+		if (initialToken)
+		    free_NegTokenInit(&ni);
+		else
+		    free_NegTokenResp(&na);
+		send_reject (minor_status, output_token);
+		HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+		return ret;
+	    }
+	    if (ret == GSS_S_COMPLETE)
+		ctx->open = 1;
+	} else
+	    ret = GSS_S_COMPLETE;
+
+	ret2 = _gss_spnego_require_mechlist_mic(minor_status, 
+						ctx,
+						&require_mic);
+	if (ret2)
+	    goto out;
+
+	ctx->require_mic = require_mic;
+
+	mic = initialToken ? ni.mechListMIC : na.mechListMIC;
+	if (mic != NULL)
+	    require_mic = 1;
+
+	if (ctx->open && require_mic) {
+	    if (mech_input_token == GSS_C_NO_BUFFER) { /* Even/One */
+		verify_mic = 1;
+		get_mic = 0;
+	    } else if (mech_output_token != GSS_C_NO_BUFFER &&
+		       mech_output_token->length == 0) { /* Odd */
+		get_mic = verify_mic = 1;
+	    } else { /* Even/One */
+		verify_mic = 0;
+		get_mic = 1;
+	    }
+
+	    if (verify_mic || get_mic) {
+		int eret;
+		size_t buf_len;
+
+    		ASN1_MALLOC_ENCODE(MechTypeList, 
+				   mech_buf.value, mech_buf.length,
+				   &ctx->initiator_mech_types, &buf_len, eret);
+		if (eret) {
+		    ret2 = GSS_S_FAILURE;
+		    *minor_status = eret;
+		    goto out;
+		}
+		if (mech_buf.length != buf_len)
+		    abort();
+	    }
+
+	    if (verify_mic) {
+		ret2 = verify_mechlist_mic(minor_status, ctx, &mech_buf, mic);
+		if (ret2) {
+		    if (get_mic)
+			send_reject (minor_status, output_token);
+		    goto out;
+		}
+
+		ctx->verified_mic = 1;
+	    }
+	} else
+	    verify_mic = get_mic = 0;
+
+	if (ctx->mech_flags & GSS_C_DCE_STYLE)
+	    require_response = (negResult != accept_completed);
+	else
+	    require_response = 0;
+
+	/*
+	 * Check whether we need to send a result: there should be only
+	 * one accept_completed response sent in the entire negotiation
+	 */
+	if ((mech_output_token != GSS_C_NO_BUFFER &&
+	     mech_output_token->length != 0)
+	    || require_response
+	    || get_mic) {
+	    ret2 = send_accept (minor_status,
+				ctx,
+				mech_output_token,
+				initialToken,
+				get_mic ? &mech_buf : NULL,
+				output_token);
+	    if (ret2)
+		goto out;
+	}
+
+     out:
+	if (ret2 != GSS_S_COMPLETE)
+	    ret = ret2;
+	if (mech_output_token != NULL)
+	    gss_release_buffer(&minor, mech_output_token);
+	if (mech_buf.value != NULL)
+	    free(mech_buf.value);
+	if (initialToken)
+	    free_NegTokenInit(&ni);
+	else
+	    free_NegTokenResp(&na);
+    }
+
+    if (ret == GSS_S_COMPLETE) {
+	if (src_name != NULL) {
+	    ret2 = gss_duplicate_name(minor_status,
+				      ctx->mech_src_name,
+				      src_name);
+	    if (ret2 != GSS_S_COMPLETE)
+		ret = ret2;
+	}
+        if (delegated_cred_handle != NULL) {
+	    *delegated_cred_handle = ctx->delegated_cred_id;
+	    ctx->delegated_cred_id = GSS_C_NO_CREDENTIAL;
+	}
+    }
+
+    if (mech_type != NULL)
+	*mech_type = ctx->negotiated_mech_type;
+    if (ret_flags != NULL)
+	*ret_flags = ctx->mech_flags;
+    if (time_rec != NULL)
+	*time_rec = ctx->mech_time_rec;
+
+    if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
+	HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+ 	return ret;
+    }
+
+    _gss_spnego_internal_delete_sec_context(&minor, context_handle,
+				   GSS_C_NO_BUFFER);
+
+    return ret;
+}
+
-- 
cgit 


From f7242f643763ccb6e10801af4ce53d0873e2d3e1 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 10 Jan 2007 01:57:32 +0000
Subject: r20640: Commit part 2/2

Update Heimdal to match current lorikeet-heimdal.  This includes
integrated PAC hooks, so Samba doesn't have to handle this any more.

This also brings in the PKINIT code, hence so many new files.

Andrew Bartlett
(This used to be commit 351f7040f7bb73b9a60b22b564686f7c2f98a729)
---
 .../heimdal/lib/gssapi/spnego/accept_sec_context.c | 978 ++++++++++++---------
 1 file changed, 575 insertions(+), 403 deletions(-)

(limited to 'source4/heimdal/lib/gssapi/spnego/accept_sec_context.c')

diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index 8a885a3e2f..2c86b3f794 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2004 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * Portions Copyright (c) 2004 PADL Software Pty Ltd.
  *
@@ -33,203 +33,85 @@
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c,v 1.6 2006/10/07 22:26:57 lha Exp $");
-
-OM_uint32
-_gss_spnego_encode_response(OM_uint32 *minor_status,
-			    const NegTokenResp *resp,
-			    gss_buffer_t data,
-			    u_char **ret_buf)
-{
-    OM_uint32 ret;
-    u_char *buf;
-    size_t buf_size, buf_len;
-
-    buf_size = 1024;
-    buf = malloc(buf_size);
-    if (buf == NULL) {
-	*minor_status = ENOMEM;
-	return GSS_S_FAILURE;
-    }
-
-    do {
-	ret = encode_NegTokenResp(buf + buf_size - 1,
-				  buf_size,
-				  resp, &buf_len);
-	if (ret == 0) {
-	    size_t tmp;
-
-	    ret = der_put_length_and_tag(buf + buf_size - buf_len - 1,
-					 buf_size - buf_len,
-					 buf_len,
-					 ASN1_C_CONTEXT,
-					 CONS,
-					 1,
-					 &tmp);
-	    if (ret == 0)
-		buf_len += tmp;
-	}
-	if (ret) {
-	    if (ret == ASN1_OVERFLOW) {
-		u_char *tmp;
-
-		buf_size *= 2;
-		tmp = realloc (buf, buf_size);
-		if (tmp == NULL) {
-		    *minor_status = ENOMEM;
-		    free(buf);
-		    return GSS_S_FAILURE;
-		}
-		buf = tmp;
-	    } else {
-		*minor_status = ret;
-		free(buf);
-		return GSS_S_FAILURE;
-	    }
-	}
-    } while (ret == ASN1_OVERFLOW);
-
-    data->value  = buf + buf_size - buf_len;
-    data->length = buf_len;
-    *ret_buf     = buf;
-
-    return GSS_S_COMPLETE;
-}
+RCSID("$Id: accept_sec_context.c,v 1.16 2006/12/19 12:10:35 lha Exp $");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
 	     gss_buffer_t output_token)
 {
-    NegTokenResp resp;
-    gss_buffer_desc data;
-    u_char *buf;
-    OM_uint32 ret;
+    NegotiationToken nt;
+    size_t size;
+
+    nt.element = choice_NegotiationToken_negTokenResp;
 
-    ALLOC(resp.negResult, 1);
-    if (resp.negResult == NULL) {
+    ALLOC(nt.u.negTokenResp.negResult, 1);
+    if (nt.u.negTokenResp.negResult == NULL) {
 	*minor_status = ENOMEM;
 	return GSS_S_FAILURE;
     }
-    *(resp.negResult)  = reject;
-    resp.supportedMech = NULL;
-    resp.responseToken = NULL;
-    resp.mechListMIC   = NULL;
+    *(nt.u.negTokenResp.negResult)  = reject;
+    nt.u.negTokenResp.supportedMech = NULL;
+    nt.u.negTokenResp.responseToken = NULL;
+    nt.u.negTokenResp.mechListMIC   = NULL;
     
-    ret = _gss_spnego_encode_response (minor_status, &resp, &data, &buf);
-    free_NegTokenResp(&resp);
-    if (ret != GSS_S_COMPLETE)
-	return ret;
+    ASN1_MALLOC_ENCODE(NegotiationToken,
+		       output_token->value, output_token->length, &nt,
+		       &size, *minor_status);
+    free_NegotiationToken(&nt);
+    if (*minor_status != 0)
+	return GSS_S_FAILURE;
 
-    output_token->value = malloc(data.length);
-    if (output_token->value == NULL) {
-	*minor_status = ENOMEM;
-	ret = GSS_S_FAILURE;
-    } else {
-	output_token->length = data.length;
-	memcpy(output_token->value, data.value, output_token->length);
-    }
-    free(buf);
-    if (ret != GSS_S_COMPLETE)
-	return ret;
     return GSS_S_BAD_MECH;
 }
 
-OM_uint32
-_gss_spnego_indicate_mechtypelist (OM_uint32 *minor_status,
-				   int includeMSCompatOID,
-				   const gssspnego_cred cred_handle,
-				   MechTypeList *mechtypelist,
-				   gss_OID *preferred_mech)
+static OM_uint32
+acceptor_approved(gss_name_t target_name, gss_OID mech)
 {
-    OM_uint32 ret;
-    gss_OID_set supported_mechs = GSS_C_NO_OID_SET;
-    int i, count;
-
-    if (cred_handle != NULL) {
-	ret = gss_inquire_cred(minor_status,
-			       cred_handle->negotiated_cred_id,
-			       NULL,
-			       NULL,
-			       NULL,
-			       &supported_mechs);
-    } else {
-	ret = gss_indicate_mechs(minor_status, &supported_mechs);
-    }
+    gss_cred_id_t cred = GSS_C_NO_CREDENTIAL;
+    gss_OID_set oidset;
+    OM_uint32 junk, ret;
 
-    if (ret != GSS_S_COMPLETE) {
-	return ret;
-    }
+    if (target_name == GSS_C_NO_NAME)
+	return GSS_S_COMPLETE;
 
-    if (supported_mechs->count == 0) {
-	*minor_status = ENOENT;
-	gss_release_oid_set(minor_status, &supported_mechs);
-	return GSS_S_FAILURE;
-    }
-
-    count = supported_mechs->count;
-    if (includeMSCompatOID)
-	count++;
-
-    mechtypelist->len = 0;
-    mechtypelist->val = calloc(count, sizeof(MechType));
-    if (mechtypelist->val == NULL) {
-	*minor_status = ENOMEM;
-	gss_release_oid_set(minor_status, &supported_mechs);
-	return GSS_S_FAILURE;
-    }
-
-    for (i = 0; i < supported_mechs->count; i++) {
-	ret = _gss_spnego_add_mech_type(&supported_mechs->elements[i],
-					includeMSCompatOID,
-					mechtypelist);
-	if (ret != 0) {
-	    *minor_status = ENOMEM;
-	    ret = GSS_S_FAILURE;
-	    break;
-	}
-    }
-
-    if (ret == GSS_S_COMPLETE && preferred_mech != NULL) {
-	ret = gss_duplicate_oid(minor_status,
-				&supported_mechs->elements[0],
-				preferred_mech);
-    }
-
-    if (ret != GSS_S_COMPLETE) {
-	free_MechTypeList(mechtypelist);
-	mechtypelist->len = 0;
-	mechtypelist->val = NULL;
-    }
-    gss_release_oid_set(minor_status, &supported_mechs);
-
-    return ret;
+    gss_create_empty_oid_set(&junk, &oidset);
+    gss_add_oid_set_member(&junk, mech, &oidset);
+    
+    ret = gss_acquire_cred(&junk, target_name, GSS_C_INDEFINITE, oidset,
+			   GSS_C_ACCEPT, &cred, NULL, NULL);
+    gss_release_oid_set(&junk, &oidset);
+    if (ret != GSS_S_COMPLETE)
+	return ret;
+    gss_release_cred(&junk, &cred);
+    
+    return GSS_S_COMPLETE;
 }
 
 static OM_uint32
 send_supported_mechs (OM_uint32 *minor_status,
 		      gss_buffer_t output_token)
 {
-    NegTokenInit ni;
+    NegotiationTokenWin nt;
     char hostname[MAXHOSTNAMELEN], *p;
     gss_buffer_desc name_buf;
     gss_OID name_type;
     gss_name_t target_princ;
     gss_name_t canon_princ;
-    OM_uint32 ret, minor;
-    u_char *buf;
-    size_t buf_size, buf_len;
+    OM_uint32 minor;
+    size_t buf_len;
     gss_buffer_desc data;
+    OM_uint32 ret;
 
-    memset(&ni, 0, sizeof(ni));
+    memset(&nt, 0, sizeof(nt));
 
-    ni.reqFlags = NULL;
-    ni.mechToken = NULL;
-    ni.negHints = NULL;
-    ni.mechListMIC = NULL;
+    nt.element = choice_NegotiationTokenWin_negTokenInit;
+    nt.u.negTokenInit.reqFlags = NULL;
+    nt.u.negTokenInit.mechToken = NULL;
+    nt.u.negTokenInit.negHints = NULL;
 
-    ret = _gss_spnego_indicate_mechtypelist(minor_status, 1,
-					    NULL,
-					    &ni.mechTypes, NULL);
+    ret = _gss_spnego_indicate_mechtypelist(minor_status, GSS_C_NO_NAME,
+					    acceptor_approved, 1, NULL,
+					    &nt.u.negTokenInit.mechTypes, NULL);
     if (ret != GSS_S_COMPLETE) {
 	return ret;
     }
@@ -237,7 +119,7 @@ send_supported_mechs (OM_uint32 *minor_status,
     memset(&target_princ, 0, sizeof(target_princ));
     if (gethostname(hostname, sizeof(hostname) - 1) != 0) {
 	*minor_status = errno;
-	free_NegTokenInit(&ni);
+	free_NegotiationTokenWin(&nt);
 	return GSS_S_FAILURE;
     }
 
@@ -255,6 +137,7 @@ send_supported_mechs (OM_uint32 *minor_status,
 			  GSS_C_NO_OID,
 			  &target_princ);
     if (ret != GSS_S_COMPLETE) {
+	free_NegotiationTokenWin(&nt);
 	return ret;
     }
 
@@ -267,6 +150,7 @@ send_supported_mechs (OM_uint32 *minor_status,
 				GSS_C_NO_OID,
 				&canon_princ);
     if (ret != GSS_S_COMPLETE) {
+	free_NegotiationTokenWin(&nt);
 	gss_release_name(&minor, &target_princ);
 	return ret;
     }
@@ -274,6 +158,7 @@ send_supported_mechs (OM_uint32 *minor_status,
     ret = gss_display_name(minor_status, canon_princ,
 			   &name_buf, &name_type);
     if (ret != GSS_S_COMPLETE) {
+	free_NegotiationTokenWin(&nt);
 	gss_release_name(&minor, &canon_princ);
 	gss_release_name(&minor, &target_princ);
 	return ret;
@@ -282,81 +167,38 @@ send_supported_mechs (OM_uint32 *minor_status,
     gss_release_name(&minor, &canon_princ);
     gss_release_name(&minor, &target_princ);
 
-    ALLOC(ni.negHints, 1);
-    if (ni.negHints == NULL) {
+    ALLOC(nt.u.negTokenInit.negHints, 1);
+    if (nt.u.negTokenInit.negHints == NULL) {
 	*minor_status = ENOMEM;
 	gss_release_buffer(&minor, &name_buf);
-	free_NegTokenInit(&ni);
+	free_NegotiationTokenWin(&nt);
 	return GSS_S_FAILURE;
     }
 
-    ALLOC(ni.negHints->hintName, 1);
-    if (ni.negHints->hintName == NULL) {
+    ALLOC(nt.u.negTokenInit.negHints->hintName, 1);
+    if (nt.u.negTokenInit.negHints->hintName == NULL) {
 	*minor_status = ENOMEM;
 	gss_release_buffer(&minor, &name_buf);
-	free_NegTokenInit(&ni);
+	free_NegotiationTokenWin(&nt);
 	return GSS_S_FAILURE;
     }
 
-    *(ni.negHints->hintName) = name_buf.value;
+    *(nt.u.negTokenInit.negHints->hintName) = name_buf.value;
     name_buf.value = NULL;
-    ni.negHints->hintAddress = NULL;
+    nt.u.negTokenInit.negHints->hintAddress = NULL;
 
-    buf_size = 1024;
-    buf = malloc(buf_size);
-    if (buf == NULL) {
-	free_NegTokenInit(&ni);
-	*minor_status = ENOMEM;
-	return GSS_S_FAILURE;
+    ASN1_MALLOC_ENCODE(NegotiationTokenWin, 
+		       data.value, data.length, &nt, &buf_len, ret);
+    free_NegotiationTokenWin(&nt);
+    if (ret) {
+	return ret;
     }
+    if (data.length != buf_len)
+	abort();
 
-    do {
-	ret = encode_NegTokenInit(buf + buf_size - 1,
-				  buf_size,
-				  &ni, &buf_len);
-	if (ret == 0) {
-	    size_t tmp;
-
-	    ret = der_put_length_and_tag(buf + buf_size - buf_len - 1,
-					 buf_size - buf_len,
-					 buf_len,
-					 ASN1_C_CONTEXT,
-					 CONS,
-					 0,
-					 &tmp);
-	    if (ret == 0)
-		buf_len += tmp;
-	}
-	if (ret) {
-	    if (ret == ASN1_OVERFLOW) {
-		u_char *tmp;
-
-		buf_size *= 2;
-		tmp = realloc (buf, buf_size);
-		if (tmp == NULL) {
-		    *minor_status = ENOMEM;
-		    free(buf);
-		    free_NegTokenInit(&ni);
-		    return GSS_S_FAILURE;
-		}
-		buf = tmp;
-	    } else {
-		*minor_status = ret;
-		free(buf);
-		free_NegTokenInit(&ni);
-		return GSS_S_FAILURE;
-	    }
-	}
-    } while (ret == ASN1_OVERFLOW);
+    ret = gss_encapsulate_token(&data, GSS_SPNEGO_MECHANISM, output_token);
 
-    data.value  = buf + buf_size - buf_len;
-    data.length = buf_len;
-
-    ret = gss_encapsulate_token(&data,
-				GSS_SPNEGO_MECHANISM,
-				output_token);
-    free (buf);
-    free_NegTokenInit (&ni);
+    free (data.value);
 
     if (ret != GSS_S_COMPLETE)
 	return ret;
@@ -374,16 +216,17 @@ send_accept (OM_uint32 *minor_status,
 	     gss_buffer_t mech_buf,
 	     gss_buffer_t output_token)
 {
-    NegTokenResp resp;
-    gss_buffer_desc data;
-    u_char *buf;
+    NegotiationToken nt;
     OM_uint32 ret;
     gss_buffer_desc mech_mic_buf;
+    size_t size;
 
-    memset(&resp, 0, sizeof(resp));
+    memset(&nt, 0, sizeof(nt));
 
-    ALLOC(resp.negResult, 1);
-    if (resp.negResult == NULL) {
+    nt.element = choice_NegotiationToken_negTokenResp;
+
+    ALLOC(nt.u.negTokenResp.negResult, 1);
+    if (nt.u.negTokenResp.negResult == NULL) {
 	*minor_status = ENOMEM;
 	return GSS_S_FAILURE;
     }
@@ -392,79 +235,85 @@ send_accept (OM_uint32 *minor_status,
 	if (mech_token != GSS_C_NO_BUFFER
 	    && mech_token->length != 0
 	    && mech_buf != GSS_C_NO_BUFFER)
-	    *(resp.negResult) = accept_incomplete;
+	    *(nt.u.negTokenResp.negResult)  = accept_incomplete;
 	else
-	    *(resp.negResult) = accept_completed;
+	    *(nt.u.negTokenResp.negResult)  = accept_completed;
     } else {
 	if (initial_response && context_handle->require_mic)
-	    *(resp.negResult) = request_mic;
+	    *(nt.u.negTokenResp.negResult)  = request_mic;
 	else
-	    *(resp.negResult) = accept_incomplete;
+	    *(nt.u.negTokenResp.negResult)  = accept_incomplete;
     }
 
     if (initial_response) {
-	ALLOC(resp.supportedMech, 1);
-	if (resp.supportedMech == NULL) {
-	    free_NegTokenResp(&resp);
+	ALLOC(nt.u.negTokenResp.supportedMech, 1);
+	if (nt.u.negTokenResp.supportedMech == NULL) {
+	    free_NegotiationToken(&nt);
 	    *minor_status = ENOMEM;
 	    return GSS_S_FAILURE;
 	}
 
 	ret = der_get_oid(context_handle->preferred_mech_type->elements,
 			  context_handle->preferred_mech_type->length,
-			  resp.supportedMech,
+			  nt.u.negTokenResp.supportedMech,
 			  NULL);
 	if (ret) {
-	    free_NegTokenResp(&resp);
+	    free_NegotiationToken(&nt);
 	    *minor_status = ENOMEM;
 	    return GSS_S_FAILURE;
 	}
     } else {
-	resp.supportedMech = NULL;
+	nt.u.negTokenResp.supportedMech = NULL;
     }
 
     if (mech_token != GSS_C_NO_BUFFER && mech_token->length != 0) {
-	ALLOC(resp.responseToken, 1);
-	if (resp.responseToken == NULL) {
-	    free_NegTokenResp(&resp);
+	ALLOC(nt.u.negTokenResp.responseToken, 1);
+	if (nt.u.negTokenResp.responseToken == NULL) {
+	    free_NegotiationToken(&nt);
 	    *minor_status = ENOMEM;
 	    return GSS_S_FAILURE;
 	}
-	resp.responseToken->length = mech_token->length;
-	resp.responseToken->data   = mech_token->value;
+	nt.u.negTokenResp.responseToken->length = mech_token->length;
+	nt.u.negTokenResp.responseToken->data   = mech_token->value;
 	mech_token->length = 0;
 	mech_token->value  = NULL;
     } else {
-	resp.responseToken = NULL;
+	nt.u.negTokenResp.responseToken = NULL;
     }
 
     if (mech_buf != GSS_C_NO_BUFFER) {
-	ALLOC(resp.mechListMIC, 1);
-	if (resp.mechListMIC == NULL) {
-	    free_NegTokenResp(&resp);
-	    *minor_status = ENOMEM;
-	    return GSS_S_FAILURE;
-	}
-
 	ret = gss_get_mic(minor_status,
 			  context_handle->negotiated_ctx_id,
 			  0,
 			  mech_buf,
 			  &mech_mic_buf);
-	if (ret != GSS_S_COMPLETE) {
-	    free_NegTokenResp(&resp);
+	if (ret == GSS_S_COMPLETE) {
+	    ALLOC(nt.u.negTokenResp.mechListMIC, 1);
+	    if (nt.u.negTokenResp.mechListMIC == NULL) {
+		gss_release_buffer(minor_status, &mech_mic_buf);
+		free_NegotiationToken(&nt);
+		*minor_status = ENOMEM;
+		return GSS_S_FAILURE;
+	    }
+	    nt.u.negTokenResp.mechListMIC->length = mech_mic_buf.length;
+	    nt.u.negTokenResp.mechListMIC->data   = mech_mic_buf.value;
+	} else if (ret == GSS_S_UNAVAILABLE) {
+	    nt.u.negTokenResp.mechListMIC = NULL;
+	} else {
+	    free_NegotiationToken(&nt);
 	    return ret;
 	}
 
-	resp.mechListMIC->length = mech_mic_buf.length;
-	resp.mechListMIC->data   = mech_mic_buf.value;
     } else
-	resp.mechListMIC = NULL;
+	nt.u.negTokenResp.mechListMIC = NULL;
  
-    ret = _gss_spnego_encode_response (minor_status, &resp, &data, &buf);
-    if (ret != GSS_S_COMPLETE) {
-	free_NegTokenResp(&resp);
-	return ret;
+    ASN1_MALLOC_ENCODE(NegotiationToken,
+		       output_token->value, output_token->length,
+		       &nt, &size, ret);
+    if (ret) {
+	free_NegotiationToken(&nt);
+	*minor_status = ret;
+	return GSS_S_FAILURE;
     }
 
     /*
@@ -472,23 +321,12 @@ send_accept (OM_uint32 *minor_status,
      * it is a SubsequentContextToken (note though RFC 1964
      * specifies encapsulation for all _Kerberos_ tokens).
      */
-    output_token->value = malloc(data.length);
-    if (output_token->value == NULL) {
-	*minor_status = ENOMEM;
-	ret = GSS_S_FAILURE;
-    } else {
-	output_token->length = data.length;
-	memcpy(output_token->value, data.value, output_token->length);
-    }
-    free(buf);
-    if (ret != GSS_S_COMPLETE) {
-	free_NegTokenResp(&resp);
-	return ret;
-    }
 
-    ret = (*(resp.negResult) == accept_completed) ? GSS_S_COMPLETE :
-						    GSS_S_CONTINUE_NEEDED;
-    free_NegTokenResp(&resp);
+    if (*(nt.u.negTokenResp.negResult) == accept_completed)
+	ret = GSS_S_COMPLETE;
+    else
+	ret = GSS_S_CONTINUE_NEEDED;
+    free_NegotiationToken(&nt);
     return ret;
 }
 
@@ -530,8 +368,164 @@ verify_mechlist_mic
     return ret;
 }
 
-OM_uint32
-_gss_spnego_accept_sec_context
+static OM_uint32
+select_mech(OM_uint32 *minor_status, MechType *mechType, int verify_p,
+	    gss_OID *mech_p)
+{
+    char mechbuf[64];
+    size_t mech_len;
+    gss_OID_desc oid;
+    OM_uint32 ret, junk;
+
+    ret = der_put_oid ((unsigned char *)mechbuf + sizeof(mechbuf) - 1,
+		       sizeof(mechbuf),
+		       mechType,
+		       &mech_len);
+    if (ret) {
+	return GSS_S_DEFECTIVE_TOKEN;
+    }
+
+    oid.length   = mech_len;
+    oid.elements = mechbuf + sizeof(mechbuf) - mech_len;
+
+    if (gss_oid_equal(&oid, GSS_SPNEGO_MECHANISM)) {
+	return GSS_S_BAD_MECH;
+    }
+
+    *minor_status = 0;
+
+    /* Translate broken MS Kebreros OID */
+    if (gss_oid_equal(&oid, &_gss_spnego_mskrb_mechanism_oid_desc)) {
+	gssapi_mech_interface mech;
+
+	mech = __gss_get_mechanism(&_gss_spnego_krb5_mechanism_oid_desc);
+	if (mech == NULL)
+	    return GSS_S_BAD_MECH;
+
+	ret = gss_duplicate_oid(minor_status,
+				&_gss_spnego_mskrb_mechanism_oid_desc,
+				mech_p);
+    } else {
+	gssapi_mech_interface mech;
+
+	mech = __gss_get_mechanism(&oid);
+	if (mech == NULL)
+	    return GSS_S_BAD_MECH;
+
+	ret = gss_duplicate_oid(minor_status,
+				&mech->gm_mech_oid,
+				mech_p);
+    }
+
+    if (verify_p) {
+	gss_name_t name = GSS_C_NO_NAME;
+	gss_buffer_desc namebuf;
+	char *str = NULL, *host, hostname[MAXHOSTNAMELEN];
+
+	host = getenv("GSSAPI_SPNEGO_NAME");
+	if (host == NULL || issuid()) {
+	    if (gethostname(hostname, sizeof(hostname)) != 0) {
+		*minor_status = errno;
+		return GSS_S_FAILURE;
+	    }
+	    asprintf(&str, "host@%s", hostname);
+	    host = str;
+	}
+
+	namebuf.length = strlen(host);
+	namebuf.value = host;
+
+	ret = gss_import_name(minor_status, &namebuf,
+			      GSS_C_NT_HOSTBASED_SERVICE, &name);
+	if (str)
+	    free(str);
+	if (ret != GSS_S_COMPLETE)
+	    return ret;
+
+	ret = acceptor_approved(name, *mech_p);
+	gss_release_name(&junk, &name);
+    }
+
+    return ret;
+}
+
+
+static OM_uint32
+acceptor_complete(OM_uint32 * minor_status,
+		  gssspnego_ctx ctx,
+		  int *get_mic,
+		  gss_buffer_t mech_buf,
+		  gss_buffer_t mech_input_token,
+		  gss_buffer_t mech_output_token,
+		  heim_octet_string *mic,
+		  gss_buffer_t output_token)
+{
+    OM_uint32 ret;
+    int require_mic, verify_mic;
+    gss_buffer_desc buf;
+
+    buf.length = 0;
+    buf.value = NULL;
+
+    ret = _gss_spnego_require_mechlist_mic(minor_status, ctx, &require_mic);
+    if (ret)
+	return ret;
+    
+    ctx->require_mic = require_mic;
+
+    if (mic != NULL)
+	require_mic = 1;
+    
+    if (ctx->open && require_mic) {
+	if (mech_input_token == GSS_C_NO_BUFFER) { /* Even/One */
+	    verify_mic = 1;
+	    *get_mic = 0;
+	} else if (mech_output_token != GSS_C_NO_BUFFER &&
+		   mech_output_token->length == 0) { /* Odd */
+	    *get_mic = verify_mic = 1;
+	} else { /* Even/One */
+	    verify_mic = 0;
+	    *get_mic = 1;
+	}
+	
+	if (verify_mic || get_mic) {
+	    int eret;
+	    size_t buf_len;
+	    
+	    ASN1_MALLOC_ENCODE(MechTypeList, 
+			       mech_buf->value, mech_buf->length,
+			       &ctx->initiator_mech_types, &buf_len, eret);
+	    if (eret) {
+		*minor_status = eret;
+		return GSS_S_FAILURE;
+	    }
+	    if (buf.length != buf_len)
+		abort();
+	}
+	
+	if (verify_mic) {
+	    ret = verify_mechlist_mic(minor_status, ctx, mech_buf, mic);
+	    if (ret) {
+		if (get_mic)
+		    send_reject (minor_status, output_token);
+		if (buf.value)
+		    free(buf.value);
+		return ret;
+	    }
+	    ctx->verified_mic = 1;
+	}
+	if (buf.value)
+	    free(buf.value);
+
+    } else
+	*get_mic = verify_mic = 0;
+    
+    return GSS_S_COMPLETE;
+}
+
+
+static OM_uint32
+acceptor_start
 	   (OM_uint32 * minor_status,
 	    gss_ctx_id_t * context_handle,
 	    const gss_cred_id_t acceptor_cred_handle,
@@ -547,40 +541,21 @@ _gss_spnego_accept_sec_context
 {
     OM_uint32 ret, ret2, minor;
     NegTokenInit ni;
-    NegTokenResp na;
-    size_t ni_len, na_len;
+    size_t ni_len;
     int i;
     gss_buffer_desc data;
     size_t len, taglen;
-    int initialToken;
-    unsigned int negResult = accept_incomplete;
     gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
-    gss_buffer_t mech_output_token = GSS_C_NO_BUFFER;
+    gss_buffer_desc mech_output_token;
     gss_buffer_desc mech_buf;
     gss_OID preferred_mech_type = GSS_C_NO_OID;
     gssspnego_ctx ctx;
     gssspnego_cred acceptor_cred = (gssspnego_cred)acceptor_cred_handle;
+    int get_mic = 0;
+    int first_ok = 0;
 
-    *minor_status = 0;
-
-    output_token->length = 0;
-    output_token->value  = NULL;
-
-    if (src_name != NULL)
-	*src_name = GSS_C_NO_NAME;
-
-    if (mech_type != NULL)
-	*mech_type = GSS_C_NO_OID;
-
-    if (ret_flags != NULL)
-	*ret_flags = 0;
-
-    if (time_rec != NULL)
-	*time_rec = 0;
-
-    if (delegated_cred_handle != NULL)
-	*delegated_cred_handle = GSS_C_NO_CREDENTIAL;
-
+    mech_output_token.value = NULL;
+    mech_output_token.length = 0;
     mech_buf.value = NULL;
 
     if (*context_handle == GSS_C_NO_CONTEXT) {
@@ -590,8 +565,7 @@ _gss_spnego_accept_sec_context
 	    return ret;
 
 	if (input_token_buffer->length == 0) {
-	    return send_supported_mechs (minor_status,
-					 output_token);
+	    return send_supported_mechs (minor_status, output_token);
 	}
     }
 
@@ -604,16 +578,12 @@ _gss_spnego_accept_sec_context
     ret = gss_decapsulate_token (input_token_buffer,
 				 GSS_SPNEGO_MECHANISM,
 				 &data);
-    initialToken = (ret == GSS_S_COMPLETE);
-
-    if (!initialToken) {
-	data.value  = input_token_buffer->value;
-	data.length = input_token_buffer->length;
-    }
+    if (ret)
+	return ret;
 
     ret = der_match_tag_and_length(data.value, data.length,
 				   ASN1_C_CONTEXT, CONS,
-				   initialToken ? 0 : 1,
+				   0,
 				   &len, &taglen);
     if (ret) {
 	*minor_status = ret;
@@ -625,70 +595,263 @@ _gss_spnego_accept_sec_context
 	return GSS_S_FAILURE;
     }
 
-    if (initialToken) {
-	ret = decode_NegTokenInit((const unsigned char *)data.value + taglen, 
+    ret = decode_NegTokenInit((const unsigned char *)data.value + taglen, 
 				  len, &ni, &ni_len);
-    } else {
-	ret = decode_NegTokenResp((const unsigned char *)data.value + taglen, 
-				  len, &na, &na_len);
-    }
     if (ret) {
 	*minor_status = ret;
 	return GSS_S_DEFECTIVE_TOKEN;
     }
 
-    if (!initialToken && na.negResult != NULL) {
-	negResult = *(na.negResult);
+    if (ni.mechTypes.len < 1) {
+	free_NegTokenInit(&ni);
+	*minor_status = 0;
+	return GSS_S_DEFECTIVE_TOKEN;
     }
 
-    if (negResult == reject || negResult == request_mic) {
-	/* request_mic should only be sent by acceptor */
-	free_NegTokenResp(&na);
-	return GSS_S_DEFECTIVE_TOKEN;
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+
+    ret = copy_MechTypeList(&ni.mechTypes, &ctx->initiator_mech_types);
+    if (ret) {
+	HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+	free_NegTokenInit(&ni);
+	*minor_status = ret;
+	return GSS_S_FAILURE;
     }
 
-    if (initialToken) {
-	for (i = 0; i < ni.mechTypes.len; ++i) {
-	    /* Call glue layer to find first mech we support */
-	    ret = _gss_spnego_select_mech(minor_status, &ni.mechTypes.val[i],
-					  &preferred_mech_type);
+    /*
+     * First we try the opportunistic token if we have support for it,
+     * don't try to verify we have credential for the token,
+     * gss_accept_sec_context will (hopefully) tell us that.
+     * If that failes, 
+     */
+
+    ret = select_mech(minor_status,
+		      &ni.mechTypes.val[0], 
+		      0,
+		      &preferred_mech_type);
+
+    if (ret == 0 && ni.mechToken != NULL) {
+	gss_cred_id_t mech_delegated_cred = GSS_C_NO_CREDENTIAL;
+	gss_cred_id_t mech_cred;
+	gss_buffer_desc ibuf;
+
+	ibuf.length = ni.mechToken->length;
+	ibuf.value = ni.mechToken->data;
+	mech_input_token = &ibuf;
+
+	if (acceptor_cred != NULL)
+	    mech_cred = acceptor_cred->negotiated_cred_id;
+	else
+	    mech_cred = GSS_C_NO_CREDENTIAL;
+	
+	if (ctx->mech_src_name != GSS_C_NO_NAME)
+	    gss_release_name(&minor, &ctx->mech_src_name);
+	
+	if (ctx->delegated_cred_id != GSS_C_NO_CREDENTIAL)
+	    _gss_spnego_release_cred(&minor, &ctx->delegated_cred_id);
+	
+	ret = gss_accept_sec_context(&minor,
+				     &ctx->negotiated_ctx_id,
+				     mech_cred,
+				     mech_input_token,
+				     input_chan_bindings,
+				     &ctx->mech_src_name,
+				     &ctx->negotiated_mech_type,
+				     &mech_output_token,
+				     &ctx->mech_flags,
+				     &ctx->mech_time_rec,
+				     &mech_delegated_cred);
+	if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
+	    if (delegated_cred_handle)
+		ret = _gss_spnego_alloc_cred(minor_status,
+					     mech_delegated_cred,
+					     delegated_cred_handle);
+	    else
+		gss_release_cred(&ret2, &mech_delegated_cred);
+
+	    ctx->preferred_mech_type = preferred_mech_type;
+	    ctx->negotiated_mech_type = preferred_mech_type;
+	    if (ret == GSS_S_COMPLETE)
+		ctx->open = 1;
+
+	    ret = acceptor_complete(minor_status,
+				    ctx,
+				    &get_mic,
+				    &mech_buf,
+				    mech_input_token,
+				    &mech_output_token,
+				    ni.mechListMIC,
+				    output_token);
+	    if (ret != GSS_S_COMPLETE)
+		goto out;
+
+	    first_ok = 1;
+	}
+    }
+
+    /*
+     * If opportunistic token failed, lets try the other mechs.
+     */
+
+    if (!first_ok) {
+
+	/* Call glue layer to find first mech we support */
+	for (i = 1; i < ni.mechTypes.len; ++i) {
+	    ret = select_mech(minor_status,
+			      &ni.mechTypes.val[i],
+			      1,
+			      &preferred_mech_type);
 	    if (ret == 0)
 		break;
 	}
 	if (preferred_mech_type == GSS_C_NO_OID) {
+	    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 	    free_NegTokenInit(&ni);
 	    return GSS_S_BAD_MECH;
 	}
+
+	ctx->preferred_mech_type = preferred_mech_type;
+	ctx->negotiated_mech_type = preferred_mech_type;
     }
 
-    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+    /*
+     * The initial token always have a response
+     */
 
-    if (initialToken) {
-	ctx->preferred_mech_type = preferred_mech_type;
-	ctx->initiator_mech_types.len = ni.mechTypes.len;
-	ctx->initiator_mech_types.val = ni.mechTypes.val;
-	ni.mechTypes.len = 0;
-	ni.mechTypes.val = NULL;
+    ret = send_accept (minor_status,
+		       ctx,
+		       &mech_output_token,
+		       1,
+		       get_mic ? &mech_buf : NULL,
+		       output_token);
+    if (ret)
+	goto out;
+    
+out:
+    if (mech_output_token.value != NULL)
+	gss_release_buffer(&minor, &mech_output_token);
+    if (mech_buf.value != NULL) {
+	free(mech_buf.value);
+	mech_buf.value = NULL;
+    }
+    free_NegTokenInit(&ni);
+
+    if (ret == GSS_S_COMPLETE) {
+	if (src_name != NULL && ctx->mech_src_name != NULL) {
+	    spnego_name name;
+
+	    name = calloc(1, sizeof(*name));
+	    if (name) {
+		name->mech = ctx->mech_src_name;
+		ctx->mech_src_name = NULL;
+		*src_name = (gss_name_t)name;
+	    } else
+		*src_name = GSS_C_NO_NAME;
+	}
+        if (delegated_cred_handle != NULL) {
+	    *delegated_cred_handle = ctx->delegated_cred_id;
+	    ctx->delegated_cred_id = GSS_C_NO_CREDENTIAL;
+	}
+    }
+    
+    if (mech_type != NULL)
+	*mech_type = ctx->negotiated_mech_type;
+    if (ret_flags != NULL)
+	*ret_flags = ctx->mech_flags;
+    if (time_rec != NULL)
+	*time_rec = ctx->mech_time_rec;
+
+    if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
+	HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
+ 	return ret;
     }
 
+    _gss_spnego_internal_delete_sec_context(&minor, context_handle,
+					    GSS_C_NO_BUFFER);
+    
+    return ret;
+}
+
+
+static OM_uint32
+acceptor_continue
+	   (OM_uint32 * minor_status,
+	    gss_ctx_id_t * context_handle,
+	    const gss_cred_id_t acceptor_cred_handle,
+	    const gss_buffer_t input_token_buffer,
+	    const gss_channel_bindings_t input_chan_bindings,
+	    gss_name_t * src_name,
+	    gss_OID * mech_type,
+	    gss_buffer_t output_token,
+	    OM_uint32 * ret_flags,
+	    OM_uint32 * time_rec,
+	    gss_cred_id_t *delegated_cred_handle
+	   )
+{
+    OM_uint32 ret, ret2, minor;
+    NegTokenResp na;
+    size_t na_len;
+    gss_buffer_desc data;
+    size_t len, taglen;
+    unsigned int negResult = accept_incomplete;
+    gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
+    gss_buffer_t mech_output_token = GSS_C_NO_BUFFER;
+    gss_buffer_desc mech_buf;
+    gssspnego_ctx ctx;
+    gssspnego_cred acceptor_cred = (gssspnego_cred)acceptor_cred_handle;
+
+    mech_buf.value = NULL;
+
+    ctx = (gssspnego_ctx)*context_handle;
+
+    /*
+     * The GSS-API encapsulation is only present on the initial
+     * context token (negTokenInit).
+     */
+
+    data.value  = input_token_buffer->value;
+    data.length = input_token_buffer->length;
+
+    ret = der_match_tag_and_length(data.value, data.length,
+				   ASN1_C_CONTEXT, CONS,
+				   1,
+				   &len, &taglen);
+    if (ret) {
+	*minor_status = ret;
+	return GSS_S_FAILURE;
+    }
+
+    if (len > data.length - taglen) {
+	*minor_status = ASN1_OVERRUN;
+	return GSS_S_FAILURE;
+    }
+
+    ret = decode_NegTokenResp((const unsigned char *)data.value + taglen, 
+			      len, &na, &na_len);
+    if (ret) {
+	*minor_status = ret;
+	return GSS_S_DEFECTIVE_TOKEN;
+    }
+
+    if (na.negResult != NULL) {
+	negResult = *(na.negResult);
+    }
+
+    HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
+
     {
 	gss_buffer_desc ibuf, obuf;
-	int require_mic, verify_mic, get_mic;
+	int require_mic, get_mic;
 	int require_response;
 	heim_octet_string *mic;
 
-	if (initialToken) {
-	    if (ni.mechToken != NULL) {
-		ibuf.length = ni.mechToken->length;
-		ibuf.value = ni.mechToken->data;
-		mech_input_token = &ibuf;
-	    }
+	if (na.responseToken != NULL) {
+	    ibuf.length = na.responseToken->length;
+	    ibuf.value = na.responseToken->data;
+	    mech_input_token = &ibuf;
 	} else {
-	    if (na.responseToken != NULL) {
-		ibuf.length = na.responseToken->length;
-		ibuf.value = na.responseToken->data;
-		mech_input_token = &ibuf;
-	    }
+	    ibuf.value = NULL;
+	    ibuf.length = 0;
 	}
 
 	if (mech_input_token != GSS_C_NO_BUFFER) {
@@ -737,10 +900,7 @@ _gss_spnego_accept_sec_context
 		mech_output_token = &obuf;
 	    }
 	    if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
-		if (initialToken)
-		    free_NegTokenInit(&ni);
-		else
-		    free_NegTokenResp(&na);
+		free_NegTokenResp(&na);
 		send_reject (minor_status, output_token);
 		HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 		return ret;
@@ -758,50 +918,19 @@ _gss_spnego_accept_sec_context
 
 	ctx->require_mic = require_mic;
 
-	mic = initialToken ? ni.mechListMIC : na.mechListMIC;
+	mic = na.mechListMIC;
 	if (mic != NULL)
 	    require_mic = 1;
 
-	if (ctx->open && require_mic) {
-	    if (mech_input_token == GSS_C_NO_BUFFER) { /* Even/One */
-		verify_mic = 1;
-		get_mic = 0;
-	    } else if (mech_output_token != GSS_C_NO_BUFFER &&
-		       mech_output_token->length == 0) { /* Odd */
-		get_mic = verify_mic = 1;
-	    } else { /* Even/One */
-		verify_mic = 0;
-		get_mic = 1;
-	    }
-
-	    if (verify_mic || get_mic) {
-		int eret;
-		size_t buf_len;
-
-    		ASN1_MALLOC_ENCODE(MechTypeList, 
-				   mech_buf.value, mech_buf.length,
-				   &ctx->initiator_mech_types, &buf_len, eret);
-		if (eret) {
-		    ret2 = GSS_S_FAILURE;
-		    *minor_status = eret;
-		    goto out;
-		}
-		if (mech_buf.length != buf_len)
-		    abort();
-	    }
-
-	    if (verify_mic) {
-		ret2 = verify_mechlist_mic(minor_status, ctx, &mech_buf, mic);
-		if (ret2) {
-		    if (get_mic)
-			send_reject (minor_status, output_token);
-		    goto out;
-		}
-
-		ctx->verified_mic = 1;
-	    }
-	} else
-	    verify_mic = get_mic = 0;
+	if (ret == GSS_S_COMPLETE)
+	    ret = acceptor_complete(minor_status,
+				    ctx,
+				    &get_mic,
+				    &mech_buf,
+				    mech_input_token,
+				    mech_output_token,
+				    na.mechListMIC,
+				    output_token);
 
 	if (ctx->mech_flags & GSS_C_DCE_STYLE)
 	    require_response = (negResult != accept_completed);
@@ -814,12 +943,13 @@ _gss_spnego_accept_sec_context
 	 */
 	if ((mech_output_token != GSS_C_NO_BUFFER &&
 	     mech_output_token->length != 0)
+	    || (ctx->open && negResult == accept_incomplete)
 	    || require_response
 	    || get_mic) {
 	    ret2 = send_accept (minor_status,
 				ctx,
 				mech_output_token,
-				initialToken,
+				0,
 				get_mic ? &mech_buf : NULL,
 				output_token);
 	    if (ret2)
@@ -833,10 +963,7 @@ _gss_spnego_accept_sec_context
 	    gss_release_buffer(&minor, mech_output_token);
 	if (mech_buf.value != NULL)
 	    free(mech_buf.value);
-	if (initialToken)
-	    free_NegTokenInit(&ni);
-	else
-	    free_NegTokenResp(&na);
+	free_NegTokenResp(&na);
     }
 
     if (ret == GSS_S_COMPLETE) {
@@ -871,3 +998,48 @@ _gss_spnego_accept_sec_context
     return ret;
 }
 
+OM_uint32
+_gss_spnego_accept_sec_context
+	   (OM_uint32 * minor_status,
+	    gss_ctx_id_t * context_handle,
+	    const gss_cred_id_t acceptor_cred_handle,
+	    const gss_buffer_t input_token_buffer,
+	    const gss_channel_bindings_t input_chan_bindings,
+	    gss_name_t * src_name,
+	    gss_OID * mech_type,
+	    gss_buffer_t output_token,
+	    OM_uint32 * ret_flags,
+	    OM_uint32 * time_rec,
+	    gss_cred_id_t *delegated_cred_handle
+	   )
+{
+    _gss_accept_sec_context_t *func;
+
+    *minor_status = 0;
+
+    output_token->length = 0;
+    output_token->value  = NULL;
+
+    if (src_name != NULL)
+	*src_name = GSS_C_NO_NAME;
+    if (mech_type != NULL)
+	*mech_type = GSS_C_NO_OID;
+    if (ret_flags != NULL)
+	*ret_flags = 0;
+    if (time_rec != NULL)
+	*time_rec = 0;
+    if (delegated_cred_handle != NULL)
+	*delegated_cred_handle = GSS_C_NO_CREDENTIAL;
+
+
+    if (*context_handle == GSS_C_NO_CONTEXT) 
+	func = acceptor_start;
+    else
+	func = acceptor_continue;
+    
+
+    return (*func)(minor_status, context_handle, acceptor_cred_handle,
+		   input_token_buffer, input_chan_bindings,
+		   src_name, mech_type, output_token, ret_flags,
+		   time_rec, delegated_cred_handle);
+}
-- 
cgit 


From 91adebe749beb0dc23cacaea316cb2b724776aad Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 13 Jun 2007 05:44:24 +0000
Subject: r23456: Update Samba4 to current lorikeet-heimdal.

Andrew Bartlett
(This used to be commit ae0f81ab235c72cceb120bcdeb051a483cf3cc4f)
---
 source4/heimdal/lib/gssapi/spnego/accept_sec_context.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

(limited to 'source4/heimdal/lib/gssapi/spnego/accept_sec_context.c')

diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index 2c86b3f794..106897b9b0 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c,v 1.16 2006/12/19 12:10:35 lha Exp $");
+RCSID("$Id: accept_sec_context.c 20929 2007-06-05 21:19:22Z lha $");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
@@ -92,7 +92,7 @@ send_supported_mechs (OM_uint32 *minor_status,
 		      gss_buffer_t output_token)
 {
     NegotiationTokenWin nt;
-    char hostname[MAXHOSTNAMELEN], *p;
+    char hostname[MAXHOSTNAMELEN + 1], *p;
     gss_buffer_desc name_buf;
     gss_OID name_type;
     gss_name_t target_princ;
@@ -117,11 +117,12 @@ send_supported_mechs (OM_uint32 *minor_status,
     }
 
     memset(&target_princ, 0, sizeof(target_princ));
-    if (gethostname(hostname, sizeof(hostname) - 1) != 0) {
+    if (gethostname(hostname, sizeof(hostname) - 2) != 0) {
 	*minor_status = errno;
 	free_NegotiationTokenWin(&nt);
 	return GSS_S_FAILURE;
     }
+    hostname[sizeof(hostname) - 1] = '\0';
 
     /* Send the constructed SAM name for this host */
     for (p = hostname; *p != '\0' && *p != '.'; p++) {
@@ -662,6 +663,11 @@ acceptor_start
 				     &ctx->mech_time_rec,
 				     &mech_delegated_cred);
 	if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
+	    ctx->preferred_mech_type = preferred_mech_type;
+	    ctx->negotiated_mech_type = preferred_mech_type;
+	    if (ret == GSS_S_COMPLETE)
+		ctx->open = 1;
+
 	    if (delegated_cred_handle)
 		ret = _gss_spnego_alloc_cred(minor_status,
 					     mech_delegated_cred,
@@ -669,11 +675,6 @@ acceptor_start
 	    else
 		gss_release_cred(&ret2, &mech_delegated_cred);
 
-	    ctx->preferred_mech_type = preferred_mech_type;
-	    ctx->negotiated_mech_type = preferred_mech_type;
-	    if (ret == GSS_S_COMPLETE)
-		ctx->open = 1;
-
 	    ret = acceptor_complete(minor_status,
 				    ctx,
 				    &get_mic,
-- 
cgit 


From ec0035c9b8e0690f3bc21f3de089c39eae660916 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Tue, 3 Jul 2007 08:00:08 +0000
Subject: r23678: Update to current lorikeet-heimdal (-r 767), which should fix
 the panics on hosts without /dev/random.

Andrew Bartlett
(This used to be commit 14a4ddb131993fec72316f7e8e371638749e6f1f)
---
 .../heimdal/lib/gssapi/spnego/accept_sec_context.c | 135 +++++++++------------
 1 file changed, 60 insertions(+), 75 deletions(-)

(limited to 'source4/heimdal/lib/gssapi/spnego/accept_sec_context.c')

diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index 106897b9b0..d20c913bf0 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c 20929 2007-06-05 21:19:22Z lha $");
+RCSID("$Id: accept_sec_context.c 21243 2007-06-20 15:16:22Z lha $");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
@@ -540,12 +540,12 @@ acceptor_start
 	    gss_cred_id_t *delegated_cred_handle
 	   )
 {
-    OM_uint32 ret, ret2, minor;
-    NegTokenInit ni;
-    size_t ni_len;
+    OM_uint32 ret, junk, minor;
+    NegotiationToken nt;
+    size_t nt_len;
+    NegTokenInit *ni;
     int i;
     gss_buffer_desc data;
-    size_t len, taglen;
     gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
     gss_buffer_desc mech_output_token;
     gss_buffer_desc mech_buf;
@@ -555,6 +555,9 @@ acceptor_start
     int get_mic = 0;
     int first_ok = 0;
 
+    if (src_name)
+	*src_name = GSS_C_NO_NAME;
+
     mech_output_token.value = NULL;
     mech_output_token.length = 0;
     mech_buf.value = NULL;
@@ -582,39 +585,30 @@ acceptor_start
     if (ret)
 	return ret;
 
-    ret = der_match_tag_and_length(data.value, data.length,
-				   ASN1_C_CONTEXT, CONS,
-				   0,
-				   &len, &taglen);
+    ret = decode_NegotiationToken(data.value, data.length, &nt, &nt_len);
+    gss_release_buffer(minor_status, &data);
     if (ret) {
 	*minor_status = ret;
-	return GSS_S_FAILURE;
-    }
-
-    if (len > data.length - taglen) {
-	*minor_status = ASN1_OVERRUN;
-	return GSS_S_FAILURE;
+	return GSS_S_DEFECTIVE_TOKEN;
     }
-
-    ret = decode_NegTokenInit((const unsigned char *)data.value + taglen, 
-				  len, &ni, &ni_len);
-    if (ret) {
-	*minor_status = ret;
+    if (nt.element != choice_NegotiationToken_negTokenInit) {
+	*minor_status = 0;
 	return GSS_S_DEFECTIVE_TOKEN;
     }
+    ni = &nt.u.negTokenInit;
 
-    if (ni.mechTypes.len < 1) {
-	free_NegTokenInit(&ni);
+    if (ni->mechTypes.len < 1) {
+	free_NegotiationToken(&nt);
 	*minor_status = 0;
 	return GSS_S_DEFECTIVE_TOKEN;
     }
 
     HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
 
-    ret = copy_MechTypeList(&ni.mechTypes, &ctx->initiator_mech_types);
+    ret = copy_MechTypeList(&ni->mechTypes, &ctx->initiator_mech_types);
     if (ret) {
 	HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
-	free_NegTokenInit(&ni);
+	free_NegotiationToken(&nt);
 	*minor_status = ret;
 	return GSS_S_FAILURE;
     }
@@ -627,17 +621,17 @@ acceptor_start
      */
 
     ret = select_mech(minor_status,
-		      &ni.mechTypes.val[0], 
+		      &ni->mechTypes.val[0], 
 		      0,
 		      &preferred_mech_type);
 
-    if (ret == 0 && ni.mechToken != NULL) {
+    if (ret == 0 && ni->mechToken != NULL) {
 	gss_cred_id_t mech_delegated_cred = GSS_C_NO_CREDENTIAL;
 	gss_cred_id_t mech_cred;
 	gss_buffer_desc ibuf;
 
-	ibuf.length = ni.mechToken->length;
-	ibuf.value = ni.mechToken->data;
+	ibuf.length = ni->mechToken->length;
+	ibuf.value = ni->mechToken->data;
 	mech_input_token = &ibuf;
 
 	if (acceptor_cred != NULL)
@@ -668,12 +662,12 @@ acceptor_start
 	    if (ret == GSS_S_COMPLETE)
 		ctx->open = 1;
 
-	    if (delegated_cred_handle)
+	    if (mech_delegated_cred && delegated_cred_handle)
 		ret = _gss_spnego_alloc_cred(minor_status,
 					     mech_delegated_cred,
 					     delegated_cred_handle);
 	    else
-		gss_release_cred(&ret2, &mech_delegated_cred);
+		gss_release_cred(&junk, &mech_delegated_cred);
 
 	    ret = acceptor_complete(minor_status,
 				    ctx,
@@ -681,7 +675,7 @@ acceptor_start
 				    &mech_buf,
 				    mech_input_token,
 				    &mech_output_token,
-				    ni.mechListMIC,
+				    ni->mechListMIC,
 				    output_token);
 	    if (ret != GSS_S_COMPLETE)
 		goto out;
@@ -697,9 +691,9 @@ acceptor_start
     if (!first_ok) {
 
 	/* Call glue layer to find first mech we support */
-	for (i = 1; i < ni.mechTypes.len; ++i) {
+	for (i = 1; i < ni->mechTypes.len; ++i) {
 	    ret = select_mech(minor_status,
-			      &ni.mechTypes.val[i],
+			      &ni->mechTypes.val[i],
 			      1,
 			      &preferred_mech_type);
 	    if (ret == 0)
@@ -707,7 +701,7 @@ acceptor_start
 	}
 	if (preferred_mech_type == GSS_C_NO_OID) {
 	    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
-	    free_NegTokenInit(&ni);
+	    free_NegotiationToken(&nt);
 	    return GSS_S_BAD_MECH;
 	}
 
@@ -735,7 +729,8 @@ out:
 	free(mech_buf.value);
 	mech_buf.value = NULL;
     }
-    free_NegTokenInit(&ni);
+    free_NegotiationToken(&nt);
+
 
     if (ret == GSS_S_COMPLETE) {
 	if (src_name != NULL && ctx->mech_src_name != NULL) {
@@ -746,8 +741,7 @@ out:
 		name->mech = ctx->mech_src_name;
 		ctx->mech_src_name = NULL;
 		*src_name = (gss_name_t)name;
-	    } else
-		*src_name = GSS_C_NO_NAME;
+	    }
 	}
         if (delegated_cred_handle != NULL) {
 	    *delegated_cred_handle = ctx->delegated_cred_id;
@@ -790,10 +784,9 @@ acceptor_continue
 	   )
 {
     OM_uint32 ret, ret2, minor;
-    NegTokenResp na;
-    size_t na_len;
-    gss_buffer_desc data;
-    size_t len, taglen;
+    NegotiationToken nt;
+    size_t nt_len;
+    NegTokenResp *na;
     unsigned int negResult = accept_incomplete;
     gss_buffer_t mech_input_token = GSS_C_NO_BUFFER;
     gss_buffer_t mech_output_token = GSS_C_NO_BUFFER;
@@ -810,45 +803,34 @@ acceptor_continue
      * context token (negTokenInit).
      */
 
-    data.value  = input_token_buffer->value;
-    data.length = input_token_buffer->length;
-
-    ret = der_match_tag_and_length(data.value, data.length,
-				   ASN1_C_CONTEXT, CONS,
-				   1,
-				   &len, &taglen);
+    ret = decode_NegotiationToken(input_token_buffer->value, 
+				  input_token_buffer->length,
+				  &nt, &nt_len);
     if (ret) {
 	*minor_status = ret;
-	return GSS_S_FAILURE;
-    }
-
-    if (len > data.length - taglen) {
-	*minor_status = ASN1_OVERRUN;
-	return GSS_S_FAILURE;
+	return GSS_S_DEFECTIVE_TOKEN;
     }
-
-    ret = decode_NegTokenResp((const unsigned char *)data.value + taglen, 
-			      len, &na, &na_len);
-    if (ret) {
-	*minor_status = ret;
+    if (nt.element != choice_NegotiationToken_negTokenResp) {
+	*minor_status = 0;
 	return GSS_S_DEFECTIVE_TOKEN;
     }
+    na = &nt.u.negTokenResp;
 
-    if (na.negResult != NULL) {
-	negResult = *(na.negResult);
+    if (na->negResult != NULL) {
+	negResult = *(na->negResult);
     }
 
     HEIMDAL_MUTEX_lock(&ctx->ctx_id_mutex);
 
     {
 	gss_buffer_desc ibuf, obuf;
-	int require_mic, get_mic;
+	int require_mic, get_mic = 0;
 	int require_response;
 	heim_octet_string *mic;
 
-	if (na.responseToken != NULL) {
-	    ibuf.length = na.responseToken->length;
-	    ibuf.value = na.responseToken->data;
+	if (na->responseToken != NULL) {
+	    ibuf.length = na->responseToken->length;
+	    ibuf.value = na->responseToken->data;
 	    mech_input_token = &ibuf;
 	} else {
 	    ibuf.value = NULL;
@@ -901,7 +883,7 @@ acceptor_continue
 		mech_output_token = &obuf;
 	    }
 	    if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
-		free_NegTokenResp(&na);
+		free_NegotiationToken(&nt);
 		send_reject (minor_status, output_token);
 		HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 		return ret;
@@ -919,7 +901,7 @@ acceptor_continue
 
 	ctx->require_mic = require_mic;
 
-	mic = na.mechListMIC;
+	mic = na->mechListMIC;
 	if (mic != NULL)
 	    require_mic = 1;
 
@@ -930,7 +912,7 @@ acceptor_continue
 				    &mech_buf,
 				    mech_input_token,
 				    mech_output_token,
-				    na.mechListMIC,
+				    na->mechListMIC,
 				    output_token);
 
 	if (ctx->mech_flags & GSS_C_DCE_STYLE)
@@ -964,16 +946,19 @@ acceptor_continue
 	    gss_release_buffer(&minor, mech_output_token);
 	if (mech_buf.value != NULL)
 	    free(mech_buf.value);
-	free_NegTokenResp(&na);
+	free_NegotiationToken(&nt);
     }
 
     if (ret == GSS_S_COMPLETE) {
-	if (src_name != NULL) {
-	    ret2 = gss_duplicate_name(minor_status,
-				      ctx->mech_src_name,
-				      src_name);
-	    if (ret2 != GSS_S_COMPLETE)
-		ret = ret2;
+	if (src_name != NULL && ctx->mech_src_name != NULL) {
+	    spnego_name name;
+
+	    name = calloc(1, sizeof(*name));
+	    if (name) {
+		name->mech = ctx->mech_src_name;
+		ctx->mech_src_name = NULL;
+		*src_name = (gss_name_t)name;
+	    }
 	}
         if (delegated_cred_handle != NULL) {
 	    *delegated_cred_handle = ctx->delegated_cred_id;
-- 
cgit 


From b39330c4873d4c3923a577e89690fc0e43b0c61a Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 22 Aug 2007 06:46:34 +0000
Subject: r24614: Merge with current lorikeet-heimdal.  This brings us one step
 closer to an alpha release.

Andrew Bartlett
(This used to be commit 30e02747d511630659c59eafec8d28f58605943b)
---
 .../heimdal/lib/gssapi/spnego/accept_sec_context.c  | 21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

(limited to 'source4/heimdal/lib/gssapi/spnego/accept_sec_context.c')

diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index d20c913bf0..1afe26f1e3 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c 21243 2007-06-20 15:16:22Z lha $");
+RCSID("$Id: accept_sec_context.c 21461 2007-07-10 14:01:13Z lha $");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
@@ -555,23 +555,16 @@ acceptor_start
     int get_mic = 0;
     int first_ok = 0;
 
-    if (src_name)
-	*src_name = GSS_C_NO_NAME;
-
     mech_output_token.value = NULL;
     mech_output_token.length = 0;
     mech_buf.value = NULL;
 
-    if (*context_handle == GSS_C_NO_CONTEXT) {
-	ret = _gss_spnego_alloc_sec_context(minor_status,
-					    context_handle);
-	if (ret != GSS_S_COMPLETE)
-	    return ret;
-
-	if (input_token_buffer->length == 0) {
-	    return send_supported_mechs (minor_status, output_token);
-	}
-    }
+    if (input_token_buffer->length == 0)
+	return send_supported_mechs (minor_status, output_token);
+	
+    ret = _gss_spnego_alloc_sec_context(minor_status, context_handle);
+    if (ret != GSS_S_COMPLETE)
+	return ret;
 
     ctx = (gssspnego_ctx)*context_handle;
 
-- 
cgit 


From 9e6b0c28712ee77ce878809c8576826a3ba08d95 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet@samba.org>
Date: Wed, 19 Mar 2008 10:17:42 +1100
Subject: Merge lorikeet-heimdal -r 787 into Samba4 tree.

Andrew Bartlett
(This used to be commit d88b530522d3cef67c24422bd5182fb875d87ee2)
---
 .../heimdal/lib/gssapi/spnego/accept_sec_context.c | 27 +++++++++++++---------
 1 file changed, 16 insertions(+), 11 deletions(-)

(limited to 'source4/heimdal/lib/gssapi/spnego/accept_sec_context.c')

diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index 1afe26f1e3..df25b0f4bf 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c 21461 2007-07-10 14:01:13Z lha $");
+RCSID("$Id: accept_sec_context.c 22600 2008-02-21 12:46:24Z lha $");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
@@ -540,7 +540,7 @@ acceptor_start
 	    gss_cred_id_t *delegated_cred_handle
 	   )
 {
-    OM_uint32 ret, junk, minor;
+    OM_uint32 ret, junk;
     NegotiationToken nt;
     size_t nt_len;
     NegTokenInit *ni;
@@ -609,7 +609,7 @@ acceptor_start
     /*
      * First we try the opportunistic token if we have support for it,
      * don't try to verify we have credential for the token,
-     * gss_accept_sec_context will (hopefully) tell us that.
+     * gss_accept_sec_context() will (hopefully) tell us that.
      * If that failes, 
      */
 
@@ -633,12 +633,12 @@ acceptor_start
 	    mech_cred = GSS_C_NO_CREDENTIAL;
 	
 	if (ctx->mech_src_name != GSS_C_NO_NAME)
-	    gss_release_name(&minor, &ctx->mech_src_name);
+	    gss_release_name(&junk, &ctx->mech_src_name);
 	
 	if (ctx->delegated_cred_id != GSS_C_NO_CREDENTIAL)
-	    _gss_spnego_release_cred(&minor, &ctx->delegated_cred_id);
+	    _gss_spnego_release_cred(&junk, &ctx->delegated_cred_id);
 	
-	ret = gss_accept_sec_context(&minor,
+	ret = gss_accept_sec_context(minor_status,
 				     &ctx->negotiated_ctx_id,
 				     mech_cred,
 				     mech_input_token,
@@ -656,7 +656,7 @@ acceptor_start
 		ctx->open = 1;
 
 	    if (mech_delegated_cred && delegated_cred_handle)
-		ret = _gss_spnego_alloc_cred(minor_status,
+		ret = _gss_spnego_alloc_cred(&junk,
 					     mech_delegated_cred,
 					     delegated_cred_handle);
 	    else
@@ -674,6 +674,8 @@ acceptor_start
 		goto out;
 
 	    first_ok = 1;
+	} else {
+	    gss_mg_collect_error(preferred_mech_type, ret, *minor_status);
 	}
     }
 
@@ -681,7 +683,9 @@ acceptor_start
      * If opportunistic token failed, lets try the other mechs.
      */
 
-    if (!first_ok) {
+    if (!first_ok && ni->mechToken != NULL) {
+
+	preferred_mech_type = GSS_C_NO_OID;
 
 	/* Call glue layer to find first mech we support */
 	for (i = 1; i < ni->mechTypes.len; ++i) {
@@ -695,7 +699,7 @@ acceptor_start
 	if (preferred_mech_type == GSS_C_NO_OID) {
 	    HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 	    free_NegotiationToken(&nt);
-	    return GSS_S_BAD_MECH;
+	    return ret;
 	}
 
 	ctx->preferred_mech_type = preferred_mech_type;
@@ -717,7 +721,7 @@ acceptor_start
     
 out:
     if (mech_output_token.value != NULL)
-	gss_release_buffer(&minor, &mech_output_token);
+	gss_release_buffer(&junk, &mech_output_token);
     if (mech_buf.value != NULL) {
 	free(mech_buf.value);
 	mech_buf.value = NULL;
@@ -754,7 +758,7 @@ out:
  	return ret;
     }
 
-    _gss_spnego_internal_delete_sec_context(&minor, context_handle,
+    _gss_spnego_internal_delete_sec_context(&junk, context_handle,
 					    GSS_C_NO_BUFFER);
     
     return ret;
@@ -877,6 +881,7 @@ acceptor_continue
 	    }
 	    if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
 		free_NegotiationToken(&nt);
+		gss_mg_collect_error(ctx->negotiated_mech_type, ret, minor);
 		send_reject (minor_status, output_token);
 		HEIMDAL_MUTEX_unlock(&ctx->ctx_id_mutex);
 		return ret;
-- 
cgit 


From a925f039ee382df0f3be434108416bab0d17e8c0 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 1 Aug 2008 07:08:51 +0200
Subject: heimdal: update to lorikeet-heimdal rev 801

metze
(This used to be commit d6c54a66fb23c784ef221a3c1cf766b72bdb5a0b)
---
 .../heimdal/lib/gssapi/spnego/accept_sec_context.c | 98 +++++++++-------------
 1 file changed, 41 insertions(+), 57 deletions(-)

(limited to 'source4/heimdal/lib/gssapi/spnego/accept_sec_context.c')

diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index df25b0f4bf..6b618092fe 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c 22600 2008-02-21 12:46:24Z lha $");
+RCSID("$Id: accept_sec_context.c 23158 2008-05-02 09:45:28Z lha $");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
@@ -376,6 +376,9 @@ select_mech(OM_uint32 *minor_status, MechType *mechType, int verify_p,
     char mechbuf[64];
     size_t mech_len;
     gss_OID_desc oid;
+    gss_OID oidp;
+    gss_OID_set mechs;
+    int i;
     OM_uint32 ret, junk;
 
     ret = der_put_oid ((unsigned char *)mechbuf + sizeof(mechbuf) - 1,
@@ -396,27 +399,29 @@ select_mech(OM_uint32 *minor_status, MechType *mechType, int verify_p,
     *minor_status = 0;
 
     /* Translate broken MS Kebreros OID */
-    if (gss_oid_equal(&oid, &_gss_spnego_mskrb_mechanism_oid_desc)) {
-	gssapi_mech_interface mech;
+    if (gss_oid_equal(&oid, &_gss_spnego_mskrb_mechanism_oid_desc))
+	    oidp = &_gss_spnego_krb5_mechanism_oid_desc;
+    else
+	    oidp = &oid;
 
-	mech = __gss_get_mechanism(&_gss_spnego_krb5_mechanism_oid_desc);
-	if (mech == NULL)
-	    return GSS_S_BAD_MECH;
 
-	ret = gss_duplicate_oid(minor_status,
-				&_gss_spnego_mskrb_mechanism_oid_desc,
-				mech_p);
-    } else {
-	gssapi_mech_interface mech;
+    ret = gss_indicate_mechs(&junk, &mechs);
+    if (ret)
+	    return (ret);
 
-	mech = __gss_get_mechanism(&oid);
-	if (mech == NULL)
-	    return GSS_S_BAD_MECH;
+    for (i = 0; i < mechs->count; i++)
+	    if (gss_oid_equal(&mechs->elements[i], oidp))
+		    break;
 
-	ret = gss_duplicate_oid(minor_status,
-				&mech->gm_mech_oid,
-				mech_p);
+    if (i == mechs->count) {
+	    gss_release_oid_set(&junk, &mechs);
+	    return GSS_S_BAD_MECH;
     }
+    gss_release_oid_set(&junk, &mechs);
+
+    ret = gss_duplicate_oid(minor_status,
+			    &oid, /* possibly this should be oidp */
+			    mech_p);
 
     if (verify_p) {
 	gss_name_t name = GSS_C_NO_NAME;
@@ -635,9 +640,6 @@ acceptor_start
 	if (ctx->mech_src_name != GSS_C_NO_NAME)
 	    gss_release_name(&junk, &ctx->mech_src_name);
 	
-	if (ctx->delegated_cred_id != GSS_C_NO_CREDENTIAL)
-	    _gss_spnego_release_cred(&junk, &ctx->delegated_cred_id);
-	
 	ret = gss_accept_sec_context(minor_status,
 				     &ctx->negotiated_ctx_id,
 				     mech_cred,
@@ -649,19 +651,20 @@ acceptor_start
 				     &ctx->mech_flags,
 				     &ctx->mech_time_rec,
 				     &mech_delegated_cred);
+
+	if (mech_delegated_cred && delegated_cred_handle) {
+	    _gss_spnego_alloc_cred(&junk,
+				   mech_delegated_cred,
+				   delegated_cred_handle);
+	} else if (mech_delegated_cred != GSS_C_NO_CREDENTIAL)
+	    gss_release_cred(&junk, &mech_delegated_cred);
+
 	if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
 	    ctx->preferred_mech_type = preferred_mech_type;
 	    ctx->negotiated_mech_type = preferred_mech_type;
 	    if (ret == GSS_S_COMPLETE)
 		ctx->open = 1;
 
-	    if (mech_delegated_cred && delegated_cred_handle)
-		ret = _gss_spnego_alloc_cred(&junk,
-					     mech_delegated_cred,
-					     delegated_cred_handle);
-	    else
-		gss_release_cred(&junk, &mech_delegated_cred);
-
 	    ret = acceptor_complete(minor_status,
 				    ctx,
 				    &get_mic,
@@ -740,10 +743,6 @@ out:
 		*src_name = (gss_name_t)name;
 	    }
 	}
-        if (delegated_cred_handle != NULL) {
-	    *delegated_cred_handle = ctx->delegated_cred_id;
-	    ctx->delegated_cred_id = GSS_C_NO_CREDENTIAL;
-	}
     }
     
     if (mech_type != NULL)
@@ -780,7 +779,7 @@ acceptor_continue
 	    gss_cred_id_t *delegated_cred_handle
 	   )
 {
-    OM_uint32 ret, ret2, minor;
+    OM_uint32 ret, ret2, minor, junk;
     NegotiationToken nt;
     size_t nt_len;
     NegTokenResp *na;
@@ -836,27 +835,16 @@ acceptor_continue
 
 	if (mech_input_token != GSS_C_NO_BUFFER) {
 	    gss_cred_id_t mech_cred;
-	    gss_cred_id_t mech_delegated_cred;
-	    gss_cred_id_t *mech_delegated_cred_p;
+	    gss_cred_id_t mech_delegated_cred = GSS_C_NO_CREDENTIAL;
 
 	    if (acceptor_cred != NULL)
 		mech_cred = acceptor_cred->negotiated_cred_id;
 	    else
 		mech_cred = GSS_C_NO_CREDENTIAL;
 
-	    if (delegated_cred_handle != NULL) {
-		mech_delegated_cred = GSS_C_NO_CREDENTIAL;
-		mech_delegated_cred_p = &mech_delegated_cred;
-	    } else {
-		mech_delegated_cred_p = NULL;
-	    }
-
 	    if (ctx->mech_src_name != GSS_C_NO_NAME)
 		gss_release_name(&minor, &ctx->mech_src_name);
 
-	    if (ctx->delegated_cred_id != GSS_C_NO_CREDENTIAL)
-		_gss_spnego_release_cred(&minor, &ctx->delegated_cred_id);
-
 	    ret = gss_accept_sec_context(&minor,
 					 &ctx->negotiated_ctx_id,
 					 mech_cred,
@@ -867,16 +855,16 @@ acceptor_continue
 					 &obuf,
 					 &ctx->mech_flags,
 					 &ctx->mech_time_rec,
-					 mech_delegated_cred_p);
+					 &mech_delegated_cred);
+
+	    if (mech_delegated_cred && delegated_cred_handle) {
+		_gss_spnego_alloc_cred(&junk,
+				       mech_delegated_cred,
+				       delegated_cred_handle);
+	    } else if (mech_delegated_cred != GSS_C_NO_CREDENTIAL)
+		gss_release_cred(&junk, &mech_delegated_cred);
+
 	    if (ret == GSS_S_COMPLETE || ret == GSS_S_CONTINUE_NEEDED) {
-		if (mech_delegated_cred_p != NULL &&
-		    mech_delegated_cred != GSS_C_NO_CREDENTIAL) {
-		    ret2 = _gss_spnego_alloc_cred(minor_status,
-						  mech_delegated_cred,
-						  &ctx->delegated_cred_id);
-		    if (ret2 != GSS_S_COMPLETE)
-			ret = ret2;
-		}
 		mech_output_token = &obuf;
 	    }
 	    if (ret != GSS_S_COMPLETE && ret != GSS_S_CONTINUE_NEEDED) {
@@ -958,10 +946,6 @@ acceptor_continue
 		*src_name = (gss_name_t)name;
 	    }
 	}
-        if (delegated_cred_handle != NULL) {
-	    *delegated_cred_handle = ctx->delegated_cred_id;
-	    ctx->delegated_cred_id = GSS_C_NO_CREDENTIAL;
-	}
     }
 
     if (mech_type != NULL)
-- 
cgit 


From 243321b4bbe273cf3a9105ca132caa2b53e2f263 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 26 Aug 2008 19:35:52 +0200
Subject: heimdal: import heimdal's trunk svn rev 23697 + lorikeet-heimdal
 patches

This is based on f56a3b1846c7d462542f2e9527f4d0ed8a34748d in my heimdal-wip repo.

metze
(This used to be commit 467a1f2163a63cdf1a4c83a69473db50e8794f53)
---
 source4/heimdal/lib/gssapi/spnego/accept_sec_context.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'source4/heimdal/lib/gssapi/spnego/accept_sec_context.c')

diff --git a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
index 6b618092fe..2afeaf080e 100644
--- a/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
+++ b/source4/heimdal/lib/gssapi/spnego/accept_sec_context.c
@@ -33,7 +33,7 @@
 
 #include "spnego/spnego_locl.h"
 
-RCSID("$Id: accept_sec_context.c 23158 2008-05-02 09:45:28Z lha $");
+RCSID("$Id$");
 
 static OM_uint32
 send_reject (OM_uint32 *minor_status,
@@ -524,7 +524,7 @@ acceptor_complete(OM_uint32 * minor_status,
 	    free(buf.value);
 
     } else
-	*get_mic = verify_mic = 0;
+	*get_mic = 0;
     
     return GSS_S_COMPLETE;
 }
-- 
cgit