17c478bd9Sstevel@tonic-gate /* 2*159d09a2SMark Phalan * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 37c478bd9Sstevel@tonic-gate * Use is subject to license terms. 47c478bd9Sstevel@tonic-gate */ 57c478bd9Sstevel@tonic-gate 67c478bd9Sstevel@tonic-gate 77c478bd9Sstevel@tonic-gate /* 87c478bd9Sstevel@tonic-gate * Copyright 1993 by OpenVision Technologies, Inc. 97c478bd9Sstevel@tonic-gate * 107c478bd9Sstevel@tonic-gate * Permission to use, copy, modify, distribute, and sell this software 117c478bd9Sstevel@tonic-gate * and its documentation for any purpose is hereby granted without fee, 127c478bd9Sstevel@tonic-gate * provided that the above copyright notice appears in all copies and 137c478bd9Sstevel@tonic-gate * that both that copyright notice and this permission notice appear in 147c478bd9Sstevel@tonic-gate * supporting documentation, and that the name of OpenVision not be used 157c478bd9Sstevel@tonic-gate * in advertising or publicity pertaining to distribution of the software 167c478bd9Sstevel@tonic-gate * without specific, written prior permission. OpenVision makes no 177c478bd9Sstevel@tonic-gate * representations about the suitability of this software for any 187c478bd9Sstevel@tonic-gate * purpose. It is provided "as is" without express or implied warranty. 197c478bd9Sstevel@tonic-gate * 207c478bd9Sstevel@tonic-gate * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, 217c478bd9Sstevel@tonic-gate * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO 227c478bd9Sstevel@tonic-gate * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR 237c478bd9Sstevel@tonic-gate * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF 247c478bd9Sstevel@tonic-gate * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR 257c478bd9Sstevel@tonic-gate * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 267c478bd9Sstevel@tonic-gate * PERFORMANCE OF THIS SOFTWARE. 277c478bd9Sstevel@tonic-gate */ 287c478bd9Sstevel@tonic-gate 29ab9b2e15Sgtb #include "gssapiP_krb5.h" 30ab9b2e15Sgtb #include "mglueP.h" /* SUNW15resync - for KGSS_ macros */ 317c478bd9Sstevel@tonic-gate 327c478bd9Sstevel@tonic-gate /* 33*159d09a2SMark Phalan * $Id: delete_sec_context.c 18396 2006-07-25 20:29:43Z lxs $ 347c478bd9Sstevel@tonic-gate */ 357c478bd9Sstevel@tonic-gate 36ab9b2e15Sgtb 377c478bd9Sstevel@tonic-gate #ifdef _KERNEL 38ab9b2e15Sgtb /* SUNW15resync - todo - unify these kernel rel oid funcs with user spc ones */ 39ab9b2e15Sgtb 40ab9b2e15Sgtb OM_uint32 41ab9b2e15Sgtb krb5_gss_internal_release_oid(minor_status, oid) 42ab9b2e15Sgtb OM_uint32 *minor_status; 43ab9b2e15Sgtb gss_OID *oid; 447c478bd9Sstevel@tonic-gate { 45ab9b2e15Sgtb /* 46ab9b2e15Sgtb * This function only knows how to release internal OIDs. It will 47ab9b2e15Sgtb * return GSS_S_CONTINUE_NEEDED for any OIDs it does not recognize. 48ab9b2e15Sgtb */ 49ab9b2e15Sgtb 50ab9b2e15Sgtb if ((*oid != gss_mech_krb5) && 51ab9b2e15Sgtb (*oid != gss_mech_krb5_old) && 52ab9b2e15Sgtb (*oid != gss_mech_krb5_wrong) && 53ab9b2e15Sgtb (*oid != gss_nt_krb5_name) && 54ab9b2e15Sgtb (*oid != gss_nt_krb5_principal)) { 55ab9b2e15Sgtb /* We don't know about this OID */ 56ab9b2e15Sgtb return(GSS_S_CONTINUE_NEEDED); 57ab9b2e15Sgtb } 58ab9b2e15Sgtb else { 59ab9b2e15Sgtb *oid = GSS_C_NO_OID; 60ab9b2e15Sgtb *minor_status = 0; 61ab9b2e15Sgtb return(GSS_S_COMPLETE); 62ab9b2e15Sgtb } 63ab9b2e15Sgtb } 647c478bd9Sstevel@tonic-gate 65ab9b2e15Sgtb OM_uint32 66ab9b2e15Sgtb generic_gss_release_oid(minor_status, oid) 67ab9b2e15Sgtb OM_uint32 *minor_status; 68ab9b2e15Sgtb gss_OID *oid; 69ab9b2e15Sgtb { 70ab9b2e15Sgtb if (minor_status) 71ab9b2e15Sgtb *minor_status = 0; 72ab9b2e15Sgtb 73ab9b2e15Sgtb if (*oid == GSS_C_NO_OID) 74ab9b2e15Sgtb return(GSS_S_COMPLETE); 75ab9b2e15Sgtb 76ab9b2e15Sgtb 77ab9b2e15Sgtb if ((*oid != GSS_C_NT_USER_NAME) && 78ab9b2e15Sgtb (*oid != GSS_C_NT_MACHINE_UID_NAME) && 79ab9b2e15Sgtb (*oid != GSS_C_NT_STRING_UID_NAME) && 80ab9b2e15Sgtb (*oid != GSS_C_NT_HOSTBASED_SERVICE) && 81ab9b2e15Sgtb (*oid != GSS_C_NT_ANONYMOUS) && 82ab9b2e15Sgtb (*oid != GSS_C_NT_EXPORT_NAME) && 83ab9b2e15Sgtb (*oid != gss_nt_service_name)) { 84ab9b2e15Sgtb FREE((*oid)->elements, (*oid)->length); 85ab9b2e15Sgtb FREE(*oid, sizeof(gss_OID_desc)); 86ab9b2e15Sgtb } 87ab9b2e15Sgtb *oid = GSS_C_NO_OID; 88ab9b2e15Sgtb return(GSS_S_COMPLETE); 89ab9b2e15Sgtb } 907c478bd9Sstevel@tonic-gate 91ab9b2e15Sgtb OM_uint32 92ab9b2e15Sgtb krb5_gss_release_oid(minor_status, oid) 93ab9b2e15Sgtb OM_uint32 *minor_status; 94ab9b2e15Sgtb gss_OID *oid; 95ab9b2e15Sgtb { 967c478bd9Sstevel@tonic-gate 97ab9b2e15Sgtb if (krb5_gss_internal_release_oid(minor_status, oid) != GSS_S_COMPLETE) { 98ab9b2e15Sgtb /* Pawn it off on the generic routine */ 99ab9b2e15Sgtb return(generic_gss_release_oid(minor_status, oid)); 100ab9b2e15Sgtb } 101ab9b2e15Sgtb else { 102ab9b2e15Sgtb *oid = GSS_C_NO_OID; 103ab9b2e15Sgtb *minor_status = 0; 104ab9b2e15Sgtb return(GSS_S_COMPLETE); 105ab9b2e15Sgtb } 1067c478bd9Sstevel@tonic-gate } 107ab9b2e15Sgtb #endif 1087c478bd9Sstevel@tonic-gate 1097c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 1107c478bd9Sstevel@tonic-gate OM_uint32 111ab9b2e15Sgtb krb5_gss_delete_sec_context(minor_status, 112ab9b2e15Sgtb context_handle, 113ab9b2e15Sgtb output_token 1147c478bd9Sstevel@tonic-gate #ifdef _KERNEL 115ab9b2e15Sgtb , gssd_ctx_verifier 1167c478bd9Sstevel@tonic-gate #endif 117ab9b2e15Sgtb ) 1187c478bd9Sstevel@tonic-gate OM_uint32 *minor_status; 1197c478bd9Sstevel@tonic-gate gss_ctx_id_t *context_handle; 1207c478bd9Sstevel@tonic-gate gss_buffer_t output_token; 1217c478bd9Sstevel@tonic-gate #ifdef _KERNEL 122ab9b2e15Sgtb OM_uint32 gssd_ctx_verifier; 1237c478bd9Sstevel@tonic-gate #endif 1247c478bd9Sstevel@tonic-gate { 125ab9b2e15Sgtb krb5_context context; 1267c478bd9Sstevel@tonic-gate krb5_gss_ctx_id_rec *ctx; 1277c478bd9Sstevel@tonic-gate 1287c478bd9Sstevel@tonic-gate if (output_token) { 1297c478bd9Sstevel@tonic-gate output_token->length = 0; 1307c478bd9Sstevel@tonic-gate output_token->value = NULL; 1317c478bd9Sstevel@tonic-gate } 1327c478bd9Sstevel@tonic-gate 1337c478bd9Sstevel@tonic-gate /*SUPPRESS 29*/ 1347c478bd9Sstevel@tonic-gate if (*context_handle == GSS_C_NO_CONTEXT) { 1357c478bd9Sstevel@tonic-gate *minor_status = 0; 136ab9b2e15Sgtb return(GSS_S_COMPLETE); 1377c478bd9Sstevel@tonic-gate } 1387c478bd9Sstevel@tonic-gate 1397c478bd9Sstevel@tonic-gate /*SUPPRESS 29*/ 1407c478bd9Sstevel@tonic-gate /* validate the context handle */ 1417c478bd9Sstevel@tonic-gate if (! kg_validate_ctx_id(*context_handle)) { 1427c478bd9Sstevel@tonic-gate *minor_status = (OM_uint32) G_VALIDATE_FAILED; 143ab9b2e15Sgtb return(GSS_S_NO_CONTEXT); 1447c478bd9Sstevel@tonic-gate } 1457c478bd9Sstevel@tonic-gate 146ab9b2e15Sgtb ctx = (krb5_gss_ctx_id_t) *context_handle; 147ab9b2e15Sgtb context = ctx->k5_context; 148ab9b2e15Sgtb 1497c478bd9Sstevel@tonic-gate /* construct a delete context token if necessary */ 1507c478bd9Sstevel@tonic-gate 1517c478bd9Sstevel@tonic-gate if (output_token) { 152ab9b2e15Sgtb OM_uint32 major; 1537c478bd9Sstevel@tonic-gate gss_buffer_desc empty; 1547c478bd9Sstevel@tonic-gate empty.length = 0; empty.value = NULL; 1557c478bd9Sstevel@tonic-gate 156ab9b2e15Sgtb if ((major = kg_seal(minor_status, *context_handle, 0, 1577c478bd9Sstevel@tonic-gate GSS_C_QOP_DEFAULT, 1587c478bd9Sstevel@tonic-gate &empty, NULL, output_token, KG_TOK_DEL_CTX))) 159ab9b2e15Sgtb return(major); 1607c478bd9Sstevel@tonic-gate } 1617c478bd9Sstevel@tonic-gate 1627c478bd9Sstevel@tonic-gate /* invalidate the context handle */ 1637c478bd9Sstevel@tonic-gate 1647c478bd9Sstevel@tonic-gate (void)kg_delete_ctx_id(*context_handle); 1657c478bd9Sstevel@tonic-gate 1667c478bd9Sstevel@tonic-gate /* free all the context state */ 1677c478bd9Sstevel@tonic-gate 1687c478bd9Sstevel@tonic-gate if (ctx->seqstate) 1697c478bd9Sstevel@tonic-gate g_order_free(&(ctx->seqstate)); 1707c478bd9Sstevel@tonic-gate 1717c478bd9Sstevel@tonic-gate if (ctx->enc) 1727c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, ctx->enc); 1737c478bd9Sstevel@tonic-gate 1747c478bd9Sstevel@tonic-gate if (ctx->seq) 1757c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, ctx->seq); 1767c478bd9Sstevel@tonic-gate 1777c478bd9Sstevel@tonic-gate if (ctx->here) 1787c478bd9Sstevel@tonic-gate krb5_free_principal(context, ctx->here); 1797c478bd9Sstevel@tonic-gate if (ctx->there) 1807c478bd9Sstevel@tonic-gate krb5_free_principal(context, ctx->there); 1817c478bd9Sstevel@tonic-gate if (ctx->subkey) 1827c478bd9Sstevel@tonic-gate krb5_free_keyblock(context, ctx->subkey); 1837c478bd9Sstevel@tonic-gate if (ctx->acceptor_subkey) 184ab9b2e15Sgtb krb5_free_keyblock(context, ctx->acceptor_subkey); 1857c478bd9Sstevel@tonic-gate 186ab9b2e15Sgtb /* We never import the auth_context into the kernel */ 1877c478bd9Sstevel@tonic-gate #ifndef _KERNEL 1887c478bd9Sstevel@tonic-gate if (ctx->auth_context) { 189ab9b2e15Sgtb if (ctx->cred_rcache) 190ab9b2e15Sgtb (void)krb5_auth_con_setrcache(context, ctx->auth_context, NULL); 191ab9b2e15Sgtb 1927c478bd9Sstevel@tonic-gate krb5_auth_con_free(context, ctx->auth_context); 1937c478bd9Sstevel@tonic-gate } 1947c478bd9Sstevel@tonic-gate #endif 1957c478bd9Sstevel@tonic-gate 196ab9b2e15Sgtb if (ctx->mech_used) 197ab9b2e15Sgtb (void) KGSS_RELEASE_OID(minor_status, &ctx->mech_used); 198*159d09a2SMark Phalan 199ab9b2e15Sgtb if (ctx->k5_context) 200ab9b2e15Sgtb krb5_free_context(ctx->k5_context); 2017c478bd9Sstevel@tonic-gate 2027c478bd9Sstevel@tonic-gate /* Zero out context */ 2037c478bd9Sstevel@tonic-gate (void) memset(ctx, 0, sizeof(*ctx)); 2047c478bd9Sstevel@tonic-gate xfree_wrap(ctx, sizeof (krb5_gss_ctx_id_rec)); 2057c478bd9Sstevel@tonic-gate 2067c478bd9Sstevel@tonic-gate /* zero the handle itself */ 2077c478bd9Sstevel@tonic-gate 2087c478bd9Sstevel@tonic-gate *context_handle = GSS_C_NO_CONTEXT; 2097c478bd9Sstevel@tonic-gate 2107c478bd9Sstevel@tonic-gate *minor_status = 0; 211ab9b2e15Sgtb return(GSS_S_COMPLETE); 2127c478bd9Sstevel@tonic-gate } 213