17c478bd9Sstevel@tonic-gate /*
2*5e01956fSGlenn Barry  * Copyright (c) 1999, 2010, Oracle and/or its affiliates. All rights reserved.
37c478bd9Sstevel@tonic-gate  */
47c478bd9Sstevel@tonic-gate /*
57c478bd9Sstevel@tonic-gate  * Copyright 1993 by OpenVision Technologies, Inc.
67c478bd9Sstevel@tonic-gate  *
77c478bd9Sstevel@tonic-gate  * Permission to use, copy, modify, distribute, and sell this software
87c478bd9Sstevel@tonic-gate  * and its documentation for any purpose is hereby granted without fee,
97c478bd9Sstevel@tonic-gate  * provided that the above copyright notice appears in all copies and
107c478bd9Sstevel@tonic-gate  * that both that copyright notice and this permission notice appear in
117c478bd9Sstevel@tonic-gate  * supporting documentation, and that the name of OpenVision not be used
127c478bd9Sstevel@tonic-gate  * in advertising or publicity pertaining to distribution of the software
137c478bd9Sstevel@tonic-gate  * without specific, written prior permission. OpenVision makes no
147c478bd9Sstevel@tonic-gate  * representations about the suitability of this software for any
157c478bd9Sstevel@tonic-gate  * purpose.  It is provided "as is" without express or implied warranty.
167c478bd9Sstevel@tonic-gate  *
177c478bd9Sstevel@tonic-gate  * OPENVISION DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE,
187c478bd9Sstevel@tonic-gate  * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO
197c478bd9Sstevel@tonic-gate  * EVENT SHALL OPENVISION BE LIABLE FOR ANY SPECIAL, INDIRECT OR
207c478bd9Sstevel@tonic-gate  * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF
217c478bd9Sstevel@tonic-gate  * USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
227c478bd9Sstevel@tonic-gate  * OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
237c478bd9Sstevel@tonic-gate  * PERFORMANCE OF THIS SOFTWARE.
247c478bd9Sstevel@tonic-gate  */
257c478bd9Sstevel@tonic-gate 
26ab9b2e15Sgtb #include "gssapiP_krb5.h"
27ab9b2e15Sgtb #include "mglueP.h"  /* SUNW15resync - for KGSS_ macros */
287c478bd9Sstevel@tonic-gate 
297c478bd9Sstevel@tonic-gate /*
30159d09a2SMark Phalan  * $Id: delete_sec_context.c 18396 2006-07-25 20:29:43Z lxs $
317c478bd9Sstevel@tonic-gate  */
327c478bd9Sstevel@tonic-gate 
33ab9b2e15Sgtb 
347c478bd9Sstevel@tonic-gate #ifdef	 _KERNEL
35ab9b2e15Sgtb /* SUNW15resync - todo - unify these kernel rel oid funcs with user spc ones */
36ab9b2e15Sgtb 
37ab9b2e15Sgtb OM_uint32
krb5_gss_internal_release_oid(minor_status,oid)38ab9b2e15Sgtb krb5_gss_internal_release_oid(minor_status, oid)
39ab9b2e15Sgtb     OM_uint32	*minor_status;
40ab9b2e15Sgtb     gss_OID	*oid;
417c478bd9Sstevel@tonic-gate {
42ab9b2e15Sgtb     /*
43ab9b2e15Sgtb      * This function only knows how to release internal OIDs. It will
44ab9b2e15Sgtb      * return GSS_S_CONTINUE_NEEDED for any OIDs it does not recognize.
45ab9b2e15Sgtb      */
46ab9b2e15Sgtb 
47ab9b2e15Sgtb     if ((*oid != gss_mech_krb5) &&
48ab9b2e15Sgtb 	(*oid != gss_mech_krb5_old) &&
49ab9b2e15Sgtb 	(*oid != gss_mech_krb5_wrong) &&
50ab9b2e15Sgtb 	(*oid != gss_nt_krb5_name) &&
51ab9b2e15Sgtb 	(*oid != gss_nt_krb5_principal)) {
52ab9b2e15Sgtb 	/* We don't know about this OID */
53ab9b2e15Sgtb 	return(GSS_S_CONTINUE_NEEDED);
54ab9b2e15Sgtb     }
55ab9b2e15Sgtb     else {
56ab9b2e15Sgtb 	*oid = GSS_C_NO_OID;
57ab9b2e15Sgtb 	*minor_status = 0;
58ab9b2e15Sgtb 	return(GSS_S_COMPLETE);
59ab9b2e15Sgtb     }
60ab9b2e15Sgtb }
617c478bd9Sstevel@tonic-gate 
62ab9b2e15Sgtb OM_uint32
generic_gss_release_oid(minor_status,oid)63ab9b2e15Sgtb generic_gss_release_oid(minor_status, oid)
64ab9b2e15Sgtb     OM_uint32	*minor_status;
65ab9b2e15Sgtb     gss_OID	*oid;
66ab9b2e15Sgtb {
67ab9b2e15Sgtb     if (minor_status)
68ab9b2e15Sgtb 	*minor_status = 0;
69ab9b2e15Sgtb 
70ab9b2e15Sgtb     if (*oid == GSS_C_NO_OID)
71ab9b2e15Sgtb 	return(GSS_S_COMPLETE);
72ab9b2e15Sgtb 
73ab9b2e15Sgtb 
74ab9b2e15Sgtb     if ((*oid != GSS_C_NT_USER_NAME) &&
75ab9b2e15Sgtb 	(*oid != GSS_C_NT_MACHINE_UID_NAME) &&
76ab9b2e15Sgtb 	(*oid != GSS_C_NT_STRING_UID_NAME) &&
77ab9b2e15Sgtb 	(*oid != GSS_C_NT_HOSTBASED_SERVICE) &&
78ab9b2e15Sgtb 	(*oid != GSS_C_NT_ANONYMOUS) &&
79ab9b2e15Sgtb 	(*oid != GSS_C_NT_EXPORT_NAME) &&
80ab9b2e15Sgtb 	(*oid != gss_nt_service_name)) {
81ab9b2e15Sgtb 	FREE((*oid)->elements, (*oid)->length);
82ab9b2e15Sgtb 	FREE(*oid, sizeof(gss_OID_desc));
83ab9b2e15Sgtb     }
84ab9b2e15Sgtb     *oid = GSS_C_NO_OID;
85ab9b2e15Sgtb     return(GSS_S_COMPLETE);
86ab9b2e15Sgtb }
877c478bd9Sstevel@tonic-gate 
88ab9b2e15Sgtb OM_uint32
krb5_gss_release_oid(minor_status,oid)89ab9b2e15Sgtb krb5_gss_release_oid(minor_status, oid)
90ab9b2e15Sgtb     OM_uint32	*minor_status;
91ab9b2e15Sgtb     gss_OID	*oid;
92ab9b2e15Sgtb {
937c478bd9Sstevel@tonic-gate 
94ab9b2e15Sgtb     if (krb5_gss_internal_release_oid(minor_status, oid) != GSS_S_COMPLETE) {
95ab9b2e15Sgtb 	/* Pawn it off on the generic routine */
96ab9b2e15Sgtb 	return(generic_gss_release_oid(minor_status, oid));
97ab9b2e15Sgtb     }
98ab9b2e15Sgtb     else {
99ab9b2e15Sgtb 	*oid = GSS_C_NO_OID;
100ab9b2e15Sgtb 	*minor_status = 0;
101ab9b2e15Sgtb 	return(GSS_S_COMPLETE);
102ab9b2e15Sgtb     }
1037c478bd9Sstevel@tonic-gate }
104ab9b2e15Sgtb #endif
1057c478bd9Sstevel@tonic-gate 
1067c478bd9Sstevel@tonic-gate /*ARGSUSED*/
1077c478bd9Sstevel@tonic-gate OM_uint32
krb5_gss_delete_sec_context(minor_status,context_handle,output_token,gssd_ctx_verifier)108ab9b2e15Sgtb krb5_gss_delete_sec_context(minor_status,
109ab9b2e15Sgtb 			    context_handle,
110ab9b2e15Sgtb 			    output_token
1117c478bd9Sstevel@tonic-gate #ifdef	 _KERNEL
112ab9b2e15Sgtb 			    , gssd_ctx_verifier
1137c478bd9Sstevel@tonic-gate #endif
114ab9b2e15Sgtb 			    )
1157c478bd9Sstevel@tonic-gate      OM_uint32 *minor_status;
1167c478bd9Sstevel@tonic-gate      gss_ctx_id_t *context_handle;
1177c478bd9Sstevel@tonic-gate      gss_buffer_t output_token;
1187c478bd9Sstevel@tonic-gate #ifdef	 _KERNEL
119ab9b2e15Sgtb      OM_uint32 gssd_ctx_verifier;
1207c478bd9Sstevel@tonic-gate #endif
1217c478bd9Sstevel@tonic-gate {
122ab9b2e15Sgtb    krb5_context context;
1237c478bd9Sstevel@tonic-gate    krb5_gss_ctx_id_rec *ctx;
1247c478bd9Sstevel@tonic-gate 
1257c478bd9Sstevel@tonic-gate    if (output_token) {
1267c478bd9Sstevel@tonic-gate       output_token->length = 0;
1277c478bd9Sstevel@tonic-gate       output_token->value = NULL;
1287c478bd9Sstevel@tonic-gate    }
1297c478bd9Sstevel@tonic-gate 
1307c478bd9Sstevel@tonic-gate    /*SUPPRESS 29*/
1317c478bd9Sstevel@tonic-gate    if (*context_handle == GSS_C_NO_CONTEXT) {
1327c478bd9Sstevel@tonic-gate       *minor_status = 0;
133ab9b2e15Sgtb       return(GSS_S_COMPLETE);
1347c478bd9Sstevel@tonic-gate    }
1357c478bd9Sstevel@tonic-gate 
1367c478bd9Sstevel@tonic-gate    /*SUPPRESS 29*/
1377c478bd9Sstevel@tonic-gate    /* validate the context handle */
1387c478bd9Sstevel@tonic-gate    if (! kg_validate_ctx_id(*context_handle)) {
1397c478bd9Sstevel@tonic-gate       *minor_status = (OM_uint32) G_VALIDATE_FAILED;
140ab9b2e15Sgtb       return(GSS_S_NO_CONTEXT);
1417c478bd9Sstevel@tonic-gate    }
1427c478bd9Sstevel@tonic-gate 
143ab9b2e15Sgtb    ctx = (krb5_gss_ctx_id_t) *context_handle;
144ab9b2e15Sgtb    context = ctx->k5_context;
145ab9b2e15Sgtb 
1467c478bd9Sstevel@tonic-gate    /* construct a delete context token if necessary */
1477c478bd9Sstevel@tonic-gate 
1487c478bd9Sstevel@tonic-gate    if (output_token) {
149ab9b2e15Sgtb       OM_uint32 major;
1507c478bd9Sstevel@tonic-gate       gss_buffer_desc empty;
1517c478bd9Sstevel@tonic-gate       empty.length = 0; empty.value = NULL;
1527c478bd9Sstevel@tonic-gate 
153ab9b2e15Sgtb       if ((major = kg_seal(minor_status, *context_handle, 0,
1547c478bd9Sstevel@tonic-gate 			   GSS_C_QOP_DEFAULT,
155*5e01956fSGlenn Barry 			   &empty, NULL, output_token, KG_TOK_DEL_CTX))) {
156*5e01956fSGlenn Barry 	 save_error_info(*minor_status, context);
157ab9b2e15Sgtb 	 return(major);
158*5e01956fSGlenn Barry       }
1597c478bd9Sstevel@tonic-gate    }
1607c478bd9Sstevel@tonic-gate 
1617c478bd9Sstevel@tonic-gate    /* invalidate the context handle */
1627c478bd9Sstevel@tonic-gate 
1637c478bd9Sstevel@tonic-gate    (void)kg_delete_ctx_id(*context_handle);
1647c478bd9Sstevel@tonic-gate 
1657c478bd9Sstevel@tonic-gate    /* free all the context state */
1667c478bd9Sstevel@tonic-gate 
1677c478bd9Sstevel@tonic-gate    if (ctx->seqstate)
1687c478bd9Sstevel@tonic-gate       g_order_free(&(ctx->seqstate));
1697c478bd9Sstevel@tonic-gate 
1707c478bd9Sstevel@tonic-gate    if (ctx->enc)
1717c478bd9Sstevel@tonic-gate       krb5_free_keyblock(context, ctx->enc);
1727c478bd9Sstevel@tonic-gate 
1737c478bd9Sstevel@tonic-gate    if (ctx->seq)
1747c478bd9Sstevel@tonic-gate       krb5_free_keyblock(context, ctx->seq);
1757c478bd9Sstevel@tonic-gate 
1767c478bd9Sstevel@tonic-gate    if (ctx->here)
1777c478bd9Sstevel@tonic-gate       krb5_free_principal(context, ctx->here);
1787c478bd9Sstevel@tonic-gate    if (ctx->there)
1797c478bd9Sstevel@tonic-gate       krb5_free_principal(context, ctx->there);
1807c478bd9Sstevel@tonic-gate    if (ctx->subkey)
1817c478bd9Sstevel@tonic-gate       krb5_free_keyblock(context, ctx->subkey);
1827c478bd9Sstevel@tonic-gate    if (ctx->acceptor_subkey)
183ab9b2e15Sgtb        krb5_free_keyblock(context, ctx->acceptor_subkey);
1847c478bd9Sstevel@tonic-gate 
185ab9b2e15Sgtb    /* We never import the auth_context into the kernel */
1867c478bd9Sstevel@tonic-gate #ifndef _KERNEL
1877c478bd9Sstevel@tonic-gate    if (ctx->auth_context) {
188ab9b2e15Sgtb        if (ctx->cred_rcache)
189ab9b2e15Sgtb 	   (void)krb5_auth_con_setrcache(context, ctx->auth_context, NULL);
190ab9b2e15Sgtb 
1917c478bd9Sstevel@tonic-gate        krb5_auth_con_free(context, ctx->auth_context);
1927c478bd9Sstevel@tonic-gate    }
1937c478bd9Sstevel@tonic-gate #endif
1947c478bd9Sstevel@tonic-gate 
195ab9b2e15Sgtb    if (ctx->mech_used)
196ab9b2e15Sgtb        (void) KGSS_RELEASE_OID(minor_status, &ctx->mech_used);
197159d09a2SMark Phalan 
198ba7b222eSGlenn Barry    if (ctx->authdata)
199ba7b222eSGlenn Barry 	krb5_free_authdata(context, ctx->authdata);
200ba7b222eSGlenn Barry 
201ab9b2e15Sgtb    if (ctx->k5_context)
202ab9b2e15Sgtb        krb5_free_context(ctx->k5_context);
2037c478bd9Sstevel@tonic-gate 
2047c478bd9Sstevel@tonic-gate    /* Zero out context */
2057c478bd9Sstevel@tonic-gate    (void) memset(ctx, 0, sizeof(*ctx));
2067c478bd9Sstevel@tonic-gate    xfree_wrap(ctx, sizeof (krb5_gss_ctx_id_rec));
2077c478bd9Sstevel@tonic-gate 
2087c478bd9Sstevel@tonic-gate    /* zero the handle itself */
2097c478bd9Sstevel@tonic-gate 
2107c478bd9Sstevel@tonic-gate    *context_handle = GSS_C_NO_CONTEXT;
2117c478bd9Sstevel@tonic-gate 
2127c478bd9Sstevel@tonic-gate    *minor_status = 0;
213ab9b2e15Sgtb    return(GSS_S_COMPLETE);
2147c478bd9Sstevel@tonic-gate }
215