xref: /illumos-gate/usr/src/lib/libgss/g_glue.c (revision 55fea89d)
17c478bd9Sstevel@tonic-gate /*
2cc35afbcSMark Phalan  * Copyright (c) 1996, 2010, Oracle and/or its affiliates. All rights reserved.
380ac04ddSGordon Ross  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
47c478bd9Sstevel@tonic-gate  */
57c478bd9Sstevel@tonic-gate 
6ba7b222eSGlenn Barry #include "mglueP.h"
75e01956fSGlenn Barry #include "gssapiP_generic.h"
87c478bd9Sstevel@tonic-gate #include <stdio.h>
9ba7b222eSGlenn Barry #ifdef HAVE_STDLIB_H
107c478bd9Sstevel@tonic-gate #include <stdlib.h>
11ba7b222eSGlenn Barry #endif
12ba7b222eSGlenn Barry #include <string.h>
137c478bd9Sstevel@tonic-gate #include <errno.h>
147c478bd9Sstevel@tonic-gate 
15ba7b222eSGlenn Barry #include "k5-platform-store_32.h"
16ba7b222eSGlenn Barry #include "k5-platform-store_16.h"
17ba7b222eSGlenn Barry /*
18ba7b222eSGlenn Barry  * SUNW17PACresync
19ba7b222eSGlenn Barry  * MIT has diff names for these GSS utilities.  Solaris needs to change
20ba7b222eSGlenn Barry  * them globally to get in sync w/MIT.
21ba7b222eSGlenn Barry  * Revisit for full 1.7 resync.
22ba7b222eSGlenn Barry  */
23ba7b222eSGlenn Barry #define gssint_get_modOptions __gss_get_modOptions
24ba7b222eSGlenn Barry #define gssint_der_length_size der_length_size
25ba7b222eSGlenn Barry #define gssint_get_der_length get_der_length
26ba7b222eSGlenn Barry #define gssint_put_der_length put_der_length
27ba7b222eSGlenn Barry #define gssint_get_mechanism __gss_get_mechanism
28ba7b222eSGlenn Barry #define gssint_get_mechanism_cred __gss_get_mechanism_cred
29ba7b222eSGlenn Barry #define gssint_copy_oid_set gss_copy_oid_set
30ba7b222eSGlenn Barry #define gssint_get_mech_type __gss_get_mech_type
31ba7b222eSGlenn Barry #define gssint_export_internal_name __gss_export_internal_name
32ba7b222eSGlenn Barry #define gssint_release_internal_name __gss_release_internal_name
33ba7b222eSGlenn Barry #define gssint_convert_name_to_union_name __gss_convert_name_to_union_name
34ba7b222eSGlenn Barry #define gssint_import_internal_name __gss_import_internal_name
35ba7b222eSGlenn Barry #define gssint_display_internal_name __gss_display_internal_name
36ba7b222eSGlenn Barry 
37ba7b222eSGlenn Barry 
387c478bd9Sstevel@tonic-gate #define	MSO_BIT (8*(sizeof (int) - 1))  /* Most significant octet bit */
397c478bd9Sstevel@tonic-gate 
40ba7b222eSGlenn Barry extern gss_mechanism *gssint_mechs_array;
41ba7b222eSGlenn Barry 
427c478bd9Sstevel@tonic-gate /*
437c478bd9Sstevel@tonic-gate  * This file contains the support routines for the glue layer.
447c478bd9Sstevel@tonic-gate  */
457c478bd9Sstevel@tonic-gate 
467c478bd9Sstevel@tonic-gate /*
477c478bd9Sstevel@tonic-gate  * get_der_length: Givin a pointer to a buffer that contains a DER encoded
487c478bd9Sstevel@tonic-gate  * length, decode the length updating the buffer to point to the character
497c478bd9Sstevel@tonic-gate  * after the DER encoding. The parameter bytes will point to the number of
507c478bd9Sstevel@tonic-gate  * bytes that made up the DER encoding of the length originally pointed to
517c478bd9Sstevel@tonic-gate  * by the buffer. Note we return -1 on error.
527c478bd9Sstevel@tonic-gate  */
537c478bd9Sstevel@tonic-gate int
gssint_get_der_length(unsigned char ** buf,unsigned int buf_len,unsigned int * bytes)54ba7b222eSGlenn Barry gssint_get_der_length(unsigned char **buf, unsigned int buf_len, unsigned int *bytes)
557c478bd9Sstevel@tonic-gate {
56ba7b222eSGlenn Barry     /* p points to the beginning of the buffer */
57ba7b222eSGlenn Barry     unsigned char *p = *buf;
58ba7b222eSGlenn Barry     int length, new_length;
59ba7b222eSGlenn Barry     unsigned int octets;
60ba7b222eSGlenn Barry 
61ba7b222eSGlenn Barry     if (buf_len < 1)
62ba7b222eSGlenn Barry 	return (-1);
63ba7b222eSGlenn Barry 
64ba7b222eSGlenn Barry     /* We should have at least one byte */
65ba7b222eSGlenn Barry     *bytes = 1;
66ba7b222eSGlenn Barry 
67ba7b222eSGlenn Barry     /*
68ba7b222eSGlenn Barry      * If the High order bit is not set then the length is just the value
69ba7b222eSGlenn Barry      * of *p.
70ba7b222eSGlenn Barry      */
71ba7b222eSGlenn Barry     if (*p < 128) {
72ba7b222eSGlenn Barry 	*buf = p+1;	/* Advance the buffer */
737c478bd9Sstevel@tonic-gate 	return (*p);		/* return the length */
74ba7b222eSGlenn Barry     }
75ba7b222eSGlenn Barry 
76ba7b222eSGlenn Barry     /*
77ba7b222eSGlenn Barry      * if the High order bit is set, then the low order bits represent
78ba7b222eSGlenn Barry      * the number of bytes that contain the DER encoding of the length.
79ba7b222eSGlenn Barry      */
80ba7b222eSGlenn Barry 
81ba7b222eSGlenn Barry     octets = *p++ & 0x7f;
82ba7b222eSGlenn Barry     *bytes += octets;
83ba7b222eSGlenn Barry 
84ba7b222eSGlenn Barry     /* See if the supplied buffer contains enough bytes for the length. */
85ba7b222eSGlenn Barry     if (octets > buf_len - 1)
86ba7b222eSGlenn Barry 	return (-1);
87ba7b222eSGlenn Barry 
88ba7b222eSGlenn Barry     /*
89ba7b222eSGlenn Barry      * Calculate a multibyte length. The length is encoded as an
90ba7b222eSGlenn Barry      * unsigned integer base 256.
91ba7b222eSGlenn Barry      */
92ba7b222eSGlenn Barry     for (length = 0; octets; octets--) {
93ba7b222eSGlenn Barry 	new_length = (length << 8) + *p++;
94ba7b222eSGlenn Barry 	if (new_length < length)  /* overflow */
95ba7b222eSGlenn Barry 	    return (-1);
96ba7b222eSGlenn Barry 	length = new_length;
97ba7b222eSGlenn Barry     }
98ba7b222eSGlenn Barry 
99ba7b222eSGlenn Barry     *buf = p; /* Advance the buffer */
100ba7b222eSGlenn Barry 
101ba7b222eSGlenn Barry     return (length);
1027c478bd9Sstevel@tonic-gate }
1037c478bd9Sstevel@tonic-gate 
1047c478bd9Sstevel@tonic-gate /*
1057c478bd9Sstevel@tonic-gate  * der_length_size: Return the number of bytes to encode a given length.
1067c478bd9Sstevel@tonic-gate  */
1077c478bd9Sstevel@tonic-gate unsigned int
gssint_der_length_size(unsigned int len)108ba7b222eSGlenn Barry gssint_der_length_size(unsigned int len)
1097c478bd9Sstevel@tonic-gate {
110ba7b222eSGlenn Barry     int i;
1117c478bd9Sstevel@tonic-gate 
112ba7b222eSGlenn Barry     if (len < 128)
113ba7b222eSGlenn Barry 	return (1);
1147c478bd9Sstevel@tonic-gate 
115ba7b222eSGlenn Barry     for (i = 0; len; i++) {
116ba7b222eSGlenn Barry 	len >>= 8;
117ba7b222eSGlenn Barry     }
1187c478bd9Sstevel@tonic-gate 
119ba7b222eSGlenn Barry     return (i+1);
1207c478bd9Sstevel@tonic-gate }
1217c478bd9Sstevel@tonic-gate 
1227c478bd9Sstevel@tonic-gate /*
1237c478bd9Sstevel@tonic-gate  * put_der_length: Encode the supplied length into the buffer pointed to
1247c478bd9Sstevel@tonic-gate  * by buf. max_length represents the maximum length of the buffer pointed
1257c478bd9Sstevel@tonic-gate  * to by buff. We will advance buf to point to the character after the newly
1267c478bd9Sstevel@tonic-gate  * DER encoded length. We return 0 on success or -l it the length cannot
1277c478bd9Sstevel@tonic-gate  * be encoded in max_len characters.
1287c478bd9Sstevel@tonic-gate  */
1297c478bd9Sstevel@tonic-gate int
gssint_put_der_length(unsigned int length,unsigned char ** buf,unsigned int max_len)130ba7b222eSGlenn Barry gssint_put_der_length(unsigned int length, unsigned char **buf, unsigned int max_len)
1317c478bd9Sstevel@tonic-gate {
132ba7b222eSGlenn Barry     unsigned char *s, *p;
133ba7b222eSGlenn Barry     unsigned int buf_len = 0;
134ba7b222eSGlenn Barry     int i, first;
1357c478bd9Sstevel@tonic-gate 
136ba7b222eSGlenn Barry     /* Oops */
137ba7b222eSGlenn Barry     if (buf == 0 || max_len < 1)
138ba7b222eSGlenn Barry 	return (-1);
1397c478bd9Sstevel@tonic-gate 
140ba7b222eSGlenn Barry     s = *buf;
1417c478bd9Sstevel@tonic-gate 
142ba7b222eSGlenn Barry     /* Single byte is the length */
143ba7b222eSGlenn Barry     if (length < 128) {
144ba7b222eSGlenn Barry 	*s++ = length;
145ba7b222eSGlenn Barry 	*buf = s;
1467c478bd9Sstevel@tonic-gate 	return (0);
147ba7b222eSGlenn Barry     }
148ba7b222eSGlenn Barry 
149ba7b222eSGlenn Barry     /* First byte contains the number of octets */
150ba7b222eSGlenn Barry     p = s + 1;
151ba7b222eSGlenn Barry 
152ba7b222eSGlenn Barry     /* Running total of the DER encoding length */
153ba7b222eSGlenn Barry     buf_len = 0;
154ba7b222eSGlenn Barry 
155ba7b222eSGlenn Barry     /*
156ba7b222eSGlenn Barry      * Encode MSB first. We do the encoding by setting a shift
157ba7b222eSGlenn Barry      * factor to MSO_BIT (24 for 32 bit words) and then shifting the length
158ba7b222eSGlenn Barry      * by the factor. We then encode the resulting low order byte.
159ba7b222eSGlenn Barry      * We subtract 8 from the shift factor and repeat to ecnode the next
160ba7b222eSGlenn Barry      * byte. We stop when the shift factor is zero or we've run out of
161ba7b222eSGlenn Barry      * buffer to encode into.
162ba7b222eSGlenn Barry      */
163ba7b222eSGlenn Barry     first = 0;
164ba7b222eSGlenn Barry     for (i = MSO_BIT; i >= 0 && buf_len <= max_len; i -= 8) {
165ba7b222eSGlenn Barry 	unsigned int v;
166ba7b222eSGlenn Barry 	v = (length >> i) & 0xff;
167ba7b222eSGlenn Barry 	if ((v) || first) {
168ba7b222eSGlenn Barry 	    buf_len += 1;
169ba7b222eSGlenn Barry 	    *p++ = v;
170ba7b222eSGlenn Barry 	    first = 1;
171ba7b222eSGlenn Barry 	}
172ba7b222eSGlenn Barry     }
173ba7b222eSGlenn Barry     if (i >= 0)			/* buffer overflow */
174ba7b222eSGlenn Barry 	return (-1);
175ba7b222eSGlenn Barry 
176ba7b222eSGlenn Barry     /*
177ba7b222eSGlenn Barry      * We go back now and set the first byte to be the length with
178ba7b222eSGlenn Barry      * the high order bit set.
179ba7b222eSGlenn Barry      */
180ba7b222eSGlenn Barry     *s = buf_len | 0x80;
181ba7b222eSGlenn Barry     *buf = p;
182ba7b222eSGlenn Barry 
183ba7b222eSGlenn Barry     return (0);
1847c478bd9Sstevel@tonic-gate }
1857c478bd9Sstevel@tonic-gate 
1867c478bd9Sstevel@tonic-gate 
1877c478bd9Sstevel@tonic-gate /*
1887c478bd9Sstevel@tonic-gate  *  glue routine for get_mech_type
1897c478bd9Sstevel@tonic-gate  *
1907c478bd9Sstevel@tonic-gate  */
1917c478bd9Sstevel@tonic-gate 
gssint_get_mech_type_oid(OID,token)192ba7b222eSGlenn Barry OM_uint32 gssint_get_mech_type_oid(OID, token)
193ba7b222eSGlenn Barry     gss_OID		OID;
194ba7b222eSGlenn Barry     gss_buffer_t	token;
195ba7b222eSGlenn Barry {
196ba7b222eSGlenn Barry     unsigned char * buffer_ptr;
197ba7b222eSGlenn Barry     int length;
198*55fea89dSDan Cross 
199ba7b222eSGlenn Barry     /*
200ba7b222eSGlenn Barry      * This routine reads the prefix of "token" in order to determine
201ba7b222eSGlenn Barry      * its mechanism type. It assumes the encoding suggested in
202ba7b222eSGlenn Barry      * Appendix B of RFC 1508. This format starts out as follows :
203ba7b222eSGlenn Barry      *
204ba7b222eSGlenn Barry      * tag for APPLICATION 0, Sequence[constructed, definite length]
205ba7b222eSGlenn Barry      * length of remainder of token
206ba7b222eSGlenn Barry      * tag of OBJECT IDENTIFIER
207ba7b222eSGlenn Barry      * length of mechanism OID
208ba7b222eSGlenn Barry      * encoding of mechanism OID
209ba7b222eSGlenn Barry      * <the rest of the token>
210ba7b222eSGlenn Barry      *
211ba7b222eSGlenn Barry      * Numerically, this looks like :
212ba7b222eSGlenn Barry      *
213ba7b222eSGlenn Barry      * 0x60
214ba7b222eSGlenn Barry      * <length> - could be multiple bytes
215ba7b222eSGlenn Barry      * 0x06
216ba7b222eSGlenn Barry      * <length> - assume only one byte, hence OID length < 127
217ba7b222eSGlenn Barry      * <mech OID bytes>
218ba7b222eSGlenn Barry      *
219ba7b222eSGlenn Barry      * The routine fills in the OID value and returns an error as necessary.
220ba7b222eSGlenn Barry      */
221*55fea89dSDan Cross 
2227c478bd9Sstevel@tonic-gate 	if (OID == NULL)
2237c478bd9Sstevel@tonic-gate 		return (GSS_S_CALL_INACCESSIBLE_WRITE);
2247c478bd9Sstevel@tonic-gate 
2257c478bd9Sstevel@tonic-gate 	if ((token == NULL) || (token->value == NULL))
226ba7b222eSGlenn Barry 	return (GSS_S_DEFECTIVE_TOKEN);
227*55fea89dSDan Cross 
228ba7b222eSGlenn Barry     /* Skip past the APP/Sequnce byte and the token length */
229*55fea89dSDan Cross 
230ba7b222eSGlenn Barry     buffer_ptr = (unsigned char *) token->value;
2317c478bd9Sstevel@tonic-gate 
232ba7b222eSGlenn Barry     if (*(buffer_ptr++) != 0x60)
233ba7b222eSGlenn Barry 	return (GSS_S_DEFECTIVE_TOKEN);
234ba7b222eSGlenn Barry     length = *buffer_ptr++;
2357c478bd9Sstevel@tonic-gate 
2367c478bd9Sstevel@tonic-gate 	/* check if token length is null */
2377c478bd9Sstevel@tonic-gate 	if (length == 0)
2387c478bd9Sstevel@tonic-gate 	    return (GSS_S_DEFECTIVE_TOKEN);
2397c478bd9Sstevel@tonic-gate 
240ba7b222eSGlenn Barry     if (length & 0x80) {
241ba7b222eSGlenn Barry 	if ((length & 0x7f) > 4)
242ba7b222eSGlenn Barry 	    return (GSS_S_DEFECTIVE_TOKEN);
243ba7b222eSGlenn Barry 	buffer_ptr += length & 0x7f;
244ba7b222eSGlenn Barry     }
245*55fea89dSDan Cross 
246ba7b222eSGlenn Barry     if (*(buffer_ptr++) != 0x06)
247ba7b222eSGlenn Barry 	return (GSS_S_DEFECTIVE_TOKEN);
248*55fea89dSDan Cross 
249ba7b222eSGlenn Barry     OID->length = (OM_uint32) *(buffer_ptr++);
250ba7b222eSGlenn Barry     OID->elements = (void *) buffer_ptr;
251ba7b222eSGlenn Barry     return (GSS_S_COMPLETE);
252ba7b222eSGlenn Barry }
2537c478bd9Sstevel@tonic-gate 
254ba7b222eSGlenn Barry /*
255ba7b222eSGlenn Barry  * The following mechanisms do not always identify themselves
256ba7b222eSGlenn Barry  * per the GSS-API specification, when interoperating with MS
257ba7b222eSGlenn Barry  * peers. We include the OIDs here so we do not have to link
258ba7b222eSGlenn Barry  * with the mechanism.
259ba7b222eSGlenn Barry  */
26080ac04ddSGordon Ross static const gss_OID_desc gss_ntlm_mechanism_oid_desc =
26180ac04ddSGordon Ross 	{10, "\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"};
26280ac04ddSGordon Ross static const gss_OID_desc gss_spnego_mechanism_oid_desc =
26380ac04ddSGordon Ross 	{6, "\x2b\x06\x01\x05\x05\x02"};
26480ac04ddSGordon Ross static const gss_OID_desc gss_krb5_mechanism_oid_desc =
26580ac04ddSGordon Ross 	{9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02"};
26680ac04ddSGordon Ross const gss_OID_desc * const gss_mech_krb5 =
26780ac04ddSGordon Ross 	&gss_krb5_mechanism_oid_desc;
268ba7b222eSGlenn Barry 
269ba7b222eSGlenn Barry #define NTLMSSP_SIGNATURE "NTLMSSP"
270ba7b222eSGlenn Barry 
gssint_get_mech_type(OID,token)271ba7b222eSGlenn Barry OM_uint32 gssint_get_mech_type(OID, token)
272ba7b222eSGlenn Barry     gss_OID		OID;
273ba7b222eSGlenn Barry     gss_buffer_t	token;
274ba7b222eSGlenn Barry {
275ba7b222eSGlenn Barry     /* Check for interoperability exceptions */
276ba7b222eSGlenn Barry     if (token->length >= sizeof(NTLMSSP_SIGNATURE) &&
277ba7b222eSGlenn Barry 	memcmp(token->value, NTLMSSP_SIGNATURE,
278ba7b222eSGlenn Barry 	       sizeof(NTLMSSP_SIGNATURE)) == 0) {
279ba7b222eSGlenn Barry 	*OID = gss_ntlm_mechanism_oid_desc;
280ba7b222eSGlenn Barry     } else if (token->length != 0 &&
281ba7b222eSGlenn Barry 	       ((char *)token->value)[0] == 0x6E) {
282ba7b222eSGlenn Barry  	/* Could be a raw AP-REQ (check for APPLICATION tag) */
283ba7b222eSGlenn Barry 	*OID = gss_krb5_mechanism_oid_desc;
284ba7b222eSGlenn Barry     } else if (token->length == 0) {
285ba7b222eSGlenn Barry 	*OID = gss_spnego_mechanism_oid_desc;
286ba7b222eSGlenn Barry     } else {
287ba7b222eSGlenn Barry 	return gssint_get_mech_type_oid(OID, token);
288ba7b222eSGlenn Barry     }
289ba7b222eSGlenn Barry 
290ba7b222eSGlenn Barry     return (GSS_S_COMPLETE);
2917c478bd9Sstevel@tonic-gate }
2927c478bd9Sstevel@tonic-gate 
2937c478bd9Sstevel@tonic-gate 
2947c478bd9Sstevel@tonic-gate /*
2957c478bd9Sstevel@tonic-gate  *  Internal routines to get and release an internal mechanism name
2967c478bd9Sstevel@tonic-gate  */
297ba7b222eSGlenn Barry 
298ba7b222eSGlenn Barry #if 0 /* SUNW17PACresync */
299ba7b222eSGlenn Barry #include "mglueP.h"
300ba7b222eSGlenn Barry #endif
301ba7b222eSGlenn Barry 
gssint_import_internal_name(minor_status,mech_type,union_name,internal_name)302*55fea89dSDan Cross OM_uint32 gssint_import_internal_name (minor_status, mech_type, union_name,
303ba7b222eSGlenn Barry 				internal_name)
3047c478bd9Sstevel@tonic-gate OM_uint32		*minor_status;
305ba7b222eSGlenn Barry gss_OID			mech_type;
3067c478bd9Sstevel@tonic-gate gss_union_name_t	union_name;
3077c478bd9Sstevel@tonic-gate gss_name_t		*internal_name;
3087c478bd9Sstevel@tonic-gate {
309ba7b222eSGlenn Barry     OM_uint32		status;
310ba7b222eSGlenn Barry     gss_mechanism	mech;
311ba7b222eSGlenn Barry 
312ba7b222eSGlenn Barry     mech = gssint_get_mechanism (mech_type);
313ba7b222eSGlenn Barry     if (mech) {
314ba7b222eSGlenn Barry 	if (mech->gss_import_name) {
315ba7b222eSGlenn Barry 	    status = mech->gss_import_name (
316ba7b222eSGlenn Barry 		    mech->context, /* SUNW17PACresync */
317ba7b222eSGlenn Barry 					    minor_status,
318ba7b222eSGlenn Barry 					    union_name->external_name,
319ba7b222eSGlenn Barry 					    union_name->name_type,
320ba7b222eSGlenn Barry 					    internal_name);
321ba7b222eSGlenn Barry 	    if (status != GSS_S_COMPLETE)
322ba7b222eSGlenn Barry 		map_error(minor_status, mech);
323ba7b222eSGlenn Barry 	} else
324ba7b222eSGlenn Barry 	    status = GSS_S_UNAVAILABLE;
325ba7b222eSGlenn Barry 
326ba7b222eSGlenn Barry 	return (status);
327ba7b222eSGlenn Barry     }
328ba7b222eSGlenn Barry 
329ba7b222eSGlenn Barry     return (GSS_S_BAD_MECH);
3307c478bd9Sstevel@tonic-gate }
3317c478bd9Sstevel@tonic-gate 
gssint_export_internal_name(minor_status,mech_type,internal_name,name_buf)332ba7b222eSGlenn Barry OM_uint32 gssint_export_internal_name(minor_status, mech_type,
333ba7b222eSGlenn Barry 				     internal_name, name_buf)
334ba7b222eSGlenn Barry     OM_uint32		*minor_status;
335ba7b222eSGlenn Barry     const gss_OID		mech_type;
336ba7b222eSGlenn Barry     const gss_name_t	internal_name;
337ba7b222eSGlenn Barry     gss_buffer_t		name_buf;
3387c478bd9Sstevel@tonic-gate {
339ba7b222eSGlenn Barry     OM_uint32 status;
340ba7b222eSGlenn Barry     gss_mechanism mech;
341ba7b222eSGlenn Barry     gss_buffer_desc dispName;
342ba7b222eSGlenn Barry     gss_OID nameOid;
343ba7b222eSGlenn Barry     unsigned char *buf = NULL;
344ba7b222eSGlenn Barry     const unsigned char tokId[] = "\x04\x01";
345ba7b222eSGlenn Barry     const unsigned int tokIdLen = 2;
346ba7b222eSGlenn Barry     const int mechOidLenLen = 2, mechOidTagLen = 1, nameLenLen = 4;
347ba7b222eSGlenn Barry     int mechOidDERLen = 0;
348ba7b222eSGlenn Barry     int mechOidLen = 0;
349ba7b222eSGlenn Barry 
350ba7b222eSGlenn Barry     mech = gssint_get_mechanism(mech_type);
351ba7b222eSGlenn Barry     if (!mech)
352ba7b222eSGlenn Barry 	return (GSS_S_BAD_MECH);
3537c478bd9Sstevel@tonic-gate 
354ba7b222eSGlenn Barry     if (mech->gss_export_name) {
355ba7b222eSGlenn Barry 	status = mech->gss_export_name(
356ba7b222eSGlenn Barry 		mech->context,  /* SUNW17PACresync */
357ba7b222eSGlenn Barry 		minor_status,
358ba7b222eSGlenn Barry 		internal_name,
359ba7b222eSGlenn Barry 		name_buf);
360ba7b222eSGlenn Barry 	if (status != GSS_S_COMPLETE)
361ba7b222eSGlenn Barry 	    map_error(minor_status, mech);
362ba7b222eSGlenn Barry 	return status;
363ba7b222eSGlenn Barry     }
364ba7b222eSGlenn Barry 
365ba7b222eSGlenn Barry     /*
366ba7b222eSGlenn Barry      * if we are here it is because the mechanism does not provide
367ba7b222eSGlenn Barry      * a gss_export_name so we will use our implementation.  We
368ba7b222eSGlenn Barry      * do required that the mechanism define a gss_display_name.
369ba7b222eSGlenn Barry      */
370ba7b222eSGlenn Barry     if (!mech->gss_display_name)
371ba7b222eSGlenn Barry 	return (GSS_S_UNAVAILABLE);
372ba7b222eSGlenn Barry 
373ba7b222eSGlenn Barry     /*
374ba7b222eSGlenn Barry      * NOTE: RFC2743 (section 3.2) governs the format of the outer
375ba7b222eSGlenn Barry      *	 wrapper of exported names; the mechanisms' specs govern
376ba7b222eSGlenn Barry      *	 the format of the inner portion of the exported name
377ba7b222eSGlenn Barry      *	 and, for some (e.g., RFC1964, the Kerberos V mech), a
378ba7b222eSGlenn Barry      *	 generic default as implemented here will do.
379ba7b222eSGlenn Barry      *
380ba7b222eSGlenn Barry      * The outer wrapper of an exported MN is: 2-octet tok Id
381ba7b222eSGlenn Barry      * (0x0401) + 2-octet network-byte order mech OID length + mech
382ba7b222eSGlenn Barry      * oid (in DER format, including DER tag and DER length) +
383ba7b222eSGlenn Barry      * 4-octet network-byte order length of inner portion + inner
384ba7b222eSGlenn Barry      * portion.
385ba7b222eSGlenn Barry      *
386ba7b222eSGlenn Barry      * For the Kerberos V mechanism the inner portion of an exported
387ba7b222eSGlenn Barry      * MN is the display name string and ignores the name type OID
388ba7b222eSGlenn Barry      * altogether.  And we hope this will be so for any future
389ba7b222eSGlenn Barry      * mechanisms also, so that factoring name export/import out of
390ba7b222eSGlenn Barry      * the mech and into libgss pays off.
391ba7b222eSGlenn Barry      */
392ba7b222eSGlenn Barry     if ((status = mech->gss_display_name(
393ba7b222eSGlenn Barry 		mech->context,
394ba7b222eSGlenn Barry 		minor_status,
395ba7b222eSGlenn Barry 					 internal_name,
396ba7b222eSGlenn Barry 					 &dispName,
397ba7b222eSGlenn Barry 					 &nameOid))
398ba7b222eSGlenn Barry 	!= GSS_S_COMPLETE) {
399ba7b222eSGlenn Barry 	map_error(minor_status, mech);
400ba7b222eSGlenn Barry 	return (status);
401ba7b222eSGlenn Barry     }
402ba7b222eSGlenn Barry 
403ba7b222eSGlenn Barry     /* determine the size of the buffer needed */
404ba7b222eSGlenn Barry     mechOidDERLen = gssint_der_length_size(mech_type->length);
405ba7b222eSGlenn Barry     name_buf->length = tokIdLen + mechOidLenLen +
406ba7b222eSGlenn Barry 	mechOidTagLen + mechOidDERLen +
407ba7b222eSGlenn Barry 	mech_type->length +
408ba7b222eSGlenn Barry 	nameLenLen + dispName.length;
409ba7b222eSGlenn Barry     if ((name_buf->value = (void*)malloc(name_buf->length)) ==
410ba7b222eSGlenn Barry 	(void*)NULL) {
411ba7b222eSGlenn Barry 	name_buf->length = 0;
412ba7b222eSGlenn Barry 	(void) gss_release_buffer(&status, &dispName);
413ba7b222eSGlenn Barry 	return (GSS_S_FAILURE);
414ba7b222eSGlenn Barry     }
415ba7b222eSGlenn Barry 
416ba7b222eSGlenn Barry     /* now create the name ..... */
417ba7b222eSGlenn Barry     buf = (unsigned char *)name_buf->value;
418ba7b222eSGlenn Barry     (void) memset(name_buf->value, 0, name_buf->length);
419ba7b222eSGlenn Barry     (void) memcpy(buf, tokId, tokIdLen);
420ba7b222eSGlenn Barry     buf += tokIdLen;
421ba7b222eSGlenn Barry 
422ba7b222eSGlenn Barry     /* spec allows only 2 bytes for the mech oid length */
423ba7b222eSGlenn Barry     mechOidLen = mechOidDERLen + mechOidTagLen + mech_type->length;
424ba7b222eSGlenn Barry     store_16_be(mechOidLen, buf);
425ba7b222eSGlenn Barry     buf += 2;
426ba7b222eSGlenn Barry 
427ba7b222eSGlenn Barry     /*
428ba7b222eSGlenn Barry      * DER Encoding of mech OID contains OID Tag (0x06), length and
429ba7b222eSGlenn Barry      * mech OID value
430ba7b222eSGlenn Barry      */
431ba7b222eSGlenn Barry     *buf++ = 0x06;
432ba7b222eSGlenn Barry     if (gssint_put_der_length(mech_type->length, &buf,
433ba7b222eSGlenn Barry 		       (name_buf->length - tokIdLen -2)) != 0) {
434ba7b222eSGlenn Barry 	name_buf->length = 0;
435ba7b222eSGlenn Barry 	free(name_buf->value);
436ba7b222eSGlenn Barry 	(void) gss_release_buffer(&status, &dispName);
437ba7b222eSGlenn Barry 	return (GSS_S_FAILURE);
438ba7b222eSGlenn Barry     }
439ba7b222eSGlenn Barry 
440ba7b222eSGlenn Barry     (void) memcpy(buf, mech_type->elements, mech_type->length);
441ba7b222eSGlenn Barry     buf += mech_type->length;
442ba7b222eSGlenn Barry 
443ba7b222eSGlenn Barry     /* spec designates the next 4 bytes for the name length */
444ba7b222eSGlenn Barry     store_32_be(dispName.length, buf);
445ba7b222eSGlenn Barry     buf += 4;
446ba7b222eSGlenn Barry 
447ba7b222eSGlenn Barry     /* for the final ingredient - add the name from gss_display_name */
448ba7b222eSGlenn Barry     (void) memcpy(buf, dispName.value, dispName.length);
449ba7b222eSGlenn Barry 
450ba7b222eSGlenn Barry     /* release the buffer obtained from gss_display_name */
451ba7b222eSGlenn Barry     (void) gss_release_buffer(minor_status, &dispName);
452ba7b222eSGlenn Barry     return (GSS_S_COMPLETE);
453ba7b222eSGlenn Barry } /*  gssint_export_internal_name */
454ba7b222eSGlenn Barry 
gssint_display_internal_name(minor_status,mech_type,internal_name,external_name,name_type)455*55fea89dSDan Cross OM_uint32 gssint_display_internal_name (minor_status, mech_type, internal_name,
456ba7b222eSGlenn Barry 				 external_name, name_type)
457ba7b222eSGlenn Barry OM_uint32	*minor_status;
458ba7b222eSGlenn Barry gss_OID		mech_type;
459ba7b222eSGlenn Barry gss_name_t	internal_name;
460ba7b222eSGlenn Barry gss_buffer_t	external_name;
461ba7b222eSGlenn Barry gss_OID		*name_type;
4627c478bd9Sstevel@tonic-gate {
463ba7b222eSGlenn Barry     OM_uint32		status;
464ba7b222eSGlenn Barry     gss_mechanism	mech;
465ba7b222eSGlenn Barry 
466ba7b222eSGlenn Barry     mech = gssint_get_mechanism (mech_type);
467ba7b222eSGlenn Barry     if (mech) {
468ba7b222eSGlenn Barry 	if (mech->gss_display_name) {
469ba7b222eSGlenn Barry 	    status = mech->gss_display_name (
470ba7b222eSGlenn Barry 		    mech->context,
471ba7b222eSGlenn Barry 					     minor_status,
472ba7b222eSGlenn Barry 					     internal_name,
473ba7b222eSGlenn Barry 					     external_name,
474ba7b222eSGlenn Barry 					     name_type);
475ba7b222eSGlenn Barry 	    if (status != GSS_S_COMPLETE)
476ba7b222eSGlenn Barry 		map_error(minor_status, mech);
477ba7b222eSGlenn Barry 	} else
478ba7b222eSGlenn Barry 	    status = GSS_S_UNAVAILABLE;
479ba7b222eSGlenn Barry 
480ba7b222eSGlenn Barry 	return (status);
481ba7b222eSGlenn Barry     }
482ba7b222eSGlenn Barry 
483ba7b222eSGlenn Barry     return (GSS_S_BAD_MECH);
484ba7b222eSGlenn Barry }
4857c478bd9Sstevel@tonic-gate 
gssint_release_internal_name(minor_status,mech_type,internal_name)486ba7b222eSGlenn Barry OM_uint32 gssint_release_internal_name (minor_status, mech_type, internal_name)
487ba7b222eSGlenn Barry OM_uint32	*minor_status;
488ba7b222eSGlenn Barry gss_OID		mech_type;
489ba7b222eSGlenn Barry gss_name_t	*internal_name;
490ba7b222eSGlenn Barry {
491ba7b222eSGlenn Barry     OM_uint32		status;
492ba7b222eSGlenn Barry     gss_mechanism	mech;
493ba7b222eSGlenn Barry 
494ba7b222eSGlenn Barry     mech = gssint_get_mechanism (mech_type);
495ba7b222eSGlenn Barry     if (mech) {
496ba7b222eSGlenn Barry 	if (mech->gss_release_name) {
497ba7b222eSGlenn Barry 	    status = mech->gss_release_name (
498ba7b222eSGlenn Barry 		    mech->context,
499ba7b222eSGlenn Barry 					     minor_status,
500ba7b222eSGlenn Barry 					     internal_name);
501ba7b222eSGlenn Barry 	    if (status != GSS_S_COMPLETE)
502ba7b222eSGlenn Barry 		map_error(minor_status, mech);
503ba7b222eSGlenn Barry 	} else
504ba7b222eSGlenn Barry 	    status = GSS_S_UNAVAILABLE;
505ba7b222eSGlenn Barry 
506ba7b222eSGlenn Barry 	return (status);
507ba7b222eSGlenn Barry     }
508ba7b222eSGlenn Barry 
509ba7b222eSGlenn Barry     return (GSS_S_BAD_MECH);
5107c478bd9Sstevel@tonic-gate }
5117c478bd9Sstevel@tonic-gate 
gssint_delete_internal_sec_context(minor_status,mech_type,internal_ctx,output_token)512ba7b222eSGlenn Barry OM_uint32 gssint_delete_internal_sec_context (minor_status,
513ba7b222eSGlenn Barry 					      mech_type,
514ba7b222eSGlenn Barry 					      internal_ctx,
515ba7b222eSGlenn Barry 					      output_token)
516ba7b222eSGlenn Barry OM_uint32	*minor_status;
517ba7b222eSGlenn Barry gss_OID		mech_type;
518ba7b222eSGlenn Barry gss_ctx_id_t	*internal_ctx;
519ba7b222eSGlenn Barry gss_buffer_t	output_token;
5207c478bd9Sstevel@tonic-gate {
521ba7b222eSGlenn Barry     OM_uint32		status;
522ba7b222eSGlenn Barry     gss_mechanism	mech;
523ba7b222eSGlenn Barry 
524ba7b222eSGlenn Barry     mech = gssint_get_mechanism (mech_type);
525ba7b222eSGlenn Barry     if (mech) {
526ba7b222eSGlenn Barry 	if (mech->gss_delete_sec_context)
527ba7b222eSGlenn Barry 	    status = mech->gss_delete_sec_context (
528ba7b222eSGlenn Barry 		    mech->context,  /* SUNW17PACresync */
529ba7b222eSGlenn Barry 		    minor_status,
530ba7b222eSGlenn Barry 		    internal_ctx,
531ba7b222eSGlenn Barry 		    output_token);
532ba7b222eSGlenn Barry 	else
533ba7b222eSGlenn Barry 	    /* SUNW17PACresync - map error here? */
534ba7b222eSGlenn Barry 	    status = GSS_S_UNAVAILABLE;
5357c478bd9Sstevel@tonic-gate 
536ba7b222eSGlenn Barry 	return (status);
537ba7b222eSGlenn Barry     }
5387c478bd9Sstevel@tonic-gate 
539ba7b222eSGlenn Barry     return (GSS_S_BAD_MECH);
540ba7b222eSGlenn Barry }
5417c478bd9Sstevel@tonic-gate 
5427c478bd9Sstevel@tonic-gate /*
5437c478bd9Sstevel@tonic-gate  * This function converts an internal gssapi name to a union gssapi
5447c478bd9Sstevel@tonic-gate  * name.  Note that internal_name should be considered "consumed" by
5457c478bd9Sstevel@tonic-gate  * this call, whether or not we return an error.
5467c478bd9Sstevel@tonic-gate  */
gssint_convert_name_to_union_name(minor_status,mech,internal_name,external_name)547ba7b222eSGlenn Barry OM_uint32 gssint_convert_name_to_union_name(minor_status, mech,
548ba7b222eSGlenn Barry 					   internal_name, external_name)
549ba7b222eSGlenn Barry     OM_uint32 *minor_status;
550ba7b222eSGlenn Barry     gss_mechanism	mech;
551ba7b222eSGlenn Barry     gss_name_t	internal_name;
552ba7b222eSGlenn Barry     gss_name_t	*external_name;
5537c478bd9Sstevel@tonic-gate {
554ba7b222eSGlenn Barry     OM_uint32 major_status,tmp;
555ba7b222eSGlenn Barry     gss_union_name_t union_name;
556ba7b222eSGlenn Barry 
557ba7b222eSGlenn Barry     union_name = (gss_union_name_t) malloc (sizeof(gss_union_name_desc));
558ba7b222eSGlenn Barry     if (!union_name) {
559ba7b222eSGlenn Barry 	major_status = GSS_S_FAILURE;
560ba7b222eSGlenn Barry 	*minor_status = ENOMEM;
561ba7b222eSGlenn Barry 	map_errcode(minor_status);
562ba7b222eSGlenn Barry 	goto allocation_failure;
563ba7b222eSGlenn Barry     }
564ba7b222eSGlenn Barry     union_name->mech_type = 0;
565ba7b222eSGlenn Barry     union_name->mech_name = internal_name;
566ba7b222eSGlenn Barry     union_name->name_type = 0;
567ba7b222eSGlenn Barry     union_name->external_name = 0;
568ba7b222eSGlenn Barry 
569ba7b222eSGlenn Barry     major_status = generic_gss_copy_oid(minor_status, &mech->mech_type,
570ba7b222eSGlenn Barry 					&union_name->mech_type);
571ba7b222eSGlenn Barry     if (major_status != GSS_S_COMPLETE) {
572ba7b222eSGlenn Barry 	map_errcode(minor_status);
573ba7b222eSGlenn Barry 	goto allocation_failure;
574ba7b222eSGlenn Barry     }
575ba7b222eSGlenn Barry 
576ba7b222eSGlenn Barry     union_name->external_name =
577ba7b222eSGlenn Barry 	(gss_buffer_t) malloc(sizeof(gss_buffer_desc));
578ba7b222eSGlenn Barry     if (!union_name->external_name) {
579ba7b222eSGlenn Barry 	    major_status = GSS_S_FAILURE;
580ba7b222eSGlenn Barry 	    *minor_status = ENOMEM;
581ba7b222eSGlenn Barry 	    goto allocation_failure;
582ba7b222eSGlenn Barry     }
583*55fea89dSDan Cross 
584cc35afbcSMark Phalan     union_name->external_name->length = 0;
585cc35afbcSMark Phalan     union_name->external_name->value = 0;
586cc35afbcSMark Phalan 
587ba7b222eSGlenn Barry     major_status = mech->gss_display_name(
588ba7b222eSGlenn Barry 	    mech->context,  /* SUNW17PACresync */
589ba7b222eSGlenn Barry 	    minor_status,
590ba7b222eSGlenn Barry 	    internal_name,
591ba7b222eSGlenn Barry 	    union_name->external_name,
592ba7b222eSGlenn Barry 	    &union_name->name_type);
593ba7b222eSGlenn Barry     if (major_status != GSS_S_COMPLETE) {
594ba7b222eSGlenn Barry 	map_error(minor_status, mech);
595ba7b222eSGlenn Barry 	goto allocation_failure;
596ba7b222eSGlenn Barry     }
597ba7b222eSGlenn Barry 
598ba7b222eSGlenn Barry     union_name->loopback = union_name;
599ba7b222eSGlenn Barry     *external_name = (gss_name_t) union_name;
600ba7b222eSGlenn Barry     return (GSS_S_COMPLETE);
6017c478bd9Sstevel@tonic-gate 
6027c478bd9Sstevel@tonic-gate allocation_failure:
603ba7b222eSGlenn Barry     if (union_name) {
604ba7b222eSGlenn Barry 	if (union_name->external_name) {
605ba7b222eSGlenn Barry 	    if (union_name->external_name->value)
606ba7b222eSGlenn Barry 		free(union_name->external_name->value);
607ba7b222eSGlenn Barry 	    free(union_name->external_name);
6087c478bd9Sstevel@tonic-gate 	}
609ba7b222eSGlenn Barry 	if (union_name->name_type)
610ba7b222eSGlenn Barry 		(void) gss_release_oid(&tmp, &union_name->name_type);
611ba7b222eSGlenn Barry 	if (union_name->mech_type)
612ba7b222eSGlenn Barry 		(void) gss_release_oid(&tmp, &union_name->mech_type);
613ba7b222eSGlenn Barry 	free(union_name);
614ba7b222eSGlenn Barry     }
615ba7b222eSGlenn Barry     /*
616ba7b222eSGlenn Barry      * do as the top comment says - since we are now owners of
617ba7b222eSGlenn Barry      * internal_name, we must clean it up
618ba7b222eSGlenn Barry      */
619ba7b222eSGlenn Barry     if (internal_name)
620ba7b222eSGlenn Barry 	(void) gssint_release_internal_name(&tmp, &mech->mech_type,
621ba7b222eSGlenn Barry 					   &internal_name);
622ba7b222eSGlenn Barry     return (major_status);
6237c478bd9Sstevel@tonic-gate }
6247c478bd9Sstevel@tonic-gate 
6257c478bd9Sstevel@tonic-gate /*
6267c478bd9Sstevel@tonic-gate  * Glue routine for returning the mechanism-specific credential from a
6277c478bd9Sstevel@tonic-gate  * external union credential.
6287c478bd9Sstevel@tonic-gate  */
6297c478bd9Sstevel@tonic-gate gss_cred_id_t
gssint_get_mechanism_cred(union_cred,mech_type)630ba7b222eSGlenn Barry gssint_get_mechanism_cred(union_cred, mech_type)
631ba7b222eSGlenn Barry     gss_union_cred_t	union_cred;
632ba7b222eSGlenn Barry     gss_OID		mech_type;
6337c478bd9Sstevel@tonic-gate {
634ba7b222eSGlenn Barry     int		i;
635ba7b222eSGlenn Barry 
636ba7b222eSGlenn Barry     if (union_cred == (gss_union_cred_t) GSS_C_NO_CREDENTIAL)
637ba7b222eSGlenn Barry 	return GSS_C_NO_CREDENTIAL;
638ba7b222eSGlenn Barry 
639ba7b222eSGlenn Barry     /*
640ba7b222eSGlenn Barry      * SUNW17PACresync
641ba7b222eSGlenn Barry      * Disable this block as it causes problems for gss_add_cred
642ba7b222eSGlenn Barry      * for HTTP SSO (and also probably causes STC gss.13 to fail too).
643ba7b222eSGlenn Barry      */
644ba7b222eSGlenn Barry #if 0
645ba7b222eSGlenn Barry     /* SPNEGO mechanism will again call into GSSAPI */
646ba7b222eSGlenn Barry     if (g_OID_equal(&gss_spnego_mechanism_oid_desc, mech_type))
647ba7b222eSGlenn Barry 	return (gss_cred_id_t)union_cred;
648ba7b222eSGlenn Barry #endif
649ba7b222eSGlenn Barry 
650ba7b222eSGlenn Barry     for (i=0; i < union_cred->count; i++) {
651ba7b222eSGlenn Barry 	if (g_OID_equal(mech_type, &union_cred->mechs_array[i]))
652ba7b222eSGlenn Barry 	    return union_cred->cred_array[i];
653ba7b222eSGlenn Barry 
654ba7b222eSGlenn Barry 	/* for SPNEGO, check the next-lower set of creds */
655ba7b222eSGlenn Barry 	if (g_OID_equal(&gss_spnego_mechanism_oid_desc, &union_cred->mechs_array[i])) {
656ba7b222eSGlenn Barry 	    gss_union_cred_t candidate_cred;
657ba7b222eSGlenn Barry 	    gss_cred_id_t    sub_cred;
658ba7b222eSGlenn Barry 
659ba7b222eSGlenn Barry 	    candidate_cred = (gss_union_cred_t)union_cred->cred_array[i];
660ba7b222eSGlenn Barry 	    sub_cred = gssint_get_mechanism_cred(candidate_cred, mech_type);
661ba7b222eSGlenn Barry 
662ba7b222eSGlenn Barry 	    if(sub_cred != GSS_C_NO_CREDENTIAL)
663ba7b222eSGlenn Barry 		return sub_cred;
6647c478bd9Sstevel@tonic-gate 	}
665ba7b222eSGlenn Barry     }
6667c478bd9Sstevel@tonic-gate 
667ba7b222eSGlenn Barry     return GSS_C_NO_CREDENTIAL;
668ba7b222eSGlenn Barry }
6697c478bd9Sstevel@tonic-gate 
6707c478bd9Sstevel@tonic-gate /*
6717c478bd9Sstevel@tonic-gate  * Routine to create and copy the gss_buffer_desc structure.
6727c478bd9Sstevel@tonic-gate  * Both space for the structure and the data is allocated.
6737c478bd9Sstevel@tonic-gate  */
6747c478bd9Sstevel@tonic-gate OM_uint32
gssint_create_copy_buffer(srcBuf,destBuf,addNullChar)675ab9b2e15Sgtb gssint_create_copy_buffer(srcBuf, destBuf, addNullChar)
676ba7b222eSGlenn Barry     const gss_buffer_t	srcBuf;
677ba7b222eSGlenn Barry     gss_buffer_t 		*destBuf;
678ba7b222eSGlenn Barry     int			addNullChar;
6797c478bd9Sstevel@tonic-gate {
680ba7b222eSGlenn Barry     gss_buffer_t aBuf;
681ba7b222eSGlenn Barry     unsigned int len;
6827c478bd9Sstevel@tonic-gate 
683ba7b222eSGlenn Barry     if (destBuf == NULL)
684ba7b222eSGlenn Barry 	return (GSS_S_CALL_INACCESSIBLE_WRITE);
6857c478bd9Sstevel@tonic-gate 
686ba7b222eSGlenn Barry     *destBuf = 0;
6877c478bd9Sstevel@tonic-gate 
688ba7b222eSGlenn Barry     aBuf = (gss_buffer_t)malloc(sizeof (gss_buffer_desc));
689ba7b222eSGlenn Barry     if (!aBuf)
690ba7b222eSGlenn Barry 	return (GSS_S_FAILURE);
6917c478bd9Sstevel@tonic-gate 
692ba7b222eSGlenn Barry     if (addNullChar)
693ba7b222eSGlenn Barry 	len = srcBuf->length + 1;
694ba7b222eSGlenn Barry     else
695ba7b222eSGlenn Barry 	len = srcBuf->length;
696ba7b222eSGlenn Barry 
697ba7b222eSGlenn Barry     if (!(aBuf->value = (void*)malloc(len))) {
698ba7b222eSGlenn Barry 	free(aBuf);
699ba7b222eSGlenn Barry 	return (GSS_S_FAILURE);
700ba7b222eSGlenn Barry     }
7017c478bd9Sstevel@tonic-gate 
7027c478bd9Sstevel@tonic-gate 
703ba7b222eSGlenn Barry     (void) memcpy(aBuf->value, srcBuf->value, srcBuf->length);
704ba7b222eSGlenn Barry     aBuf->length = srcBuf->length;
705ba7b222eSGlenn Barry     *destBuf = aBuf;
7067c478bd9Sstevel@tonic-gate 
707ba7b222eSGlenn Barry     /* optionally add a NULL character */
708ba7b222eSGlenn Barry     if (addNullChar)
709ba7b222eSGlenn Barry 	((char *)aBuf->value)[aBuf->length] = '\0';
7107c478bd9Sstevel@tonic-gate 
711ba7b222eSGlenn Barry     return (GSS_S_COMPLETE);
712ba7b222eSGlenn Barry } /* ****** gssint_create_copy_buffer  ****** */
7137c478bd9Sstevel@tonic-gate 
714