1 /*
2  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 #pragma ident	"%Z%%M%	%I%	%E% SMI"
7 
8 /*
9  * lib/gssapi/krb5/import_sec_context.c
10  *
11  * Copyright 1995,2004 by the Massachusetts Institute of Technology.
12  * All Rights Reserved.
13  *
14  * Export of this software from the United States of America may
15  *   require a specific license from the United States Government.
16  *   It is the responsibility of any person or organization contemplating
17  *   export to obtain such a license before exporting.
18  *
19  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
20  * distribute this software and its documentation for any purpose and
21  * without fee is hereby granted, provided that the above copyright
22  * notice appear in all copies and that both that copyright notice and
23  * this permission notice appear in supporting documentation, and that
24  * the name of M.I.T. not be used in advertising or publicity pertaining
25  * to distribution of the software without specific, written prior
26  * permission.  Furthermore if you modify this software you must label
27  * your software as modified software and not distribute it in such a
28  * fashion that it might be confused with the original M.I.T. software.
29  * M.I.T. makes no representations about the suitability of
30  * this software for any purpose.  It is provided "as is" without express
31  * or implied warranty.
32  *
33  */
34 
35 /*
36  * import_sec_context.c	- Internalize the security context.
37  */
38 #include "gssapiP_krb5.h"
39 /* for serialization initialization functions */
40 #include "k5-int.h"
41 #include "mglueP.h"  /* SUNW15resync - for KGSS_ macros */
42 
43 #ifdef	 _KERNEL
44 extern OM_uint32 kgss_release_oid(OM_uint32 *, gss_OID *);
45 #endif
46 
47 
48 /*
49  * Fix up the OID of the mechanism so that uses the static version of
50  * the OID if possible.
51  */
52 gss_OID krb5_gss_convert_static_mech_oid(oid)
53      gss_OID	oid;
54 {
55 	const gss_OID_desc 	*p;
56 	OM_uint32		minor_status;
57 
58 	for (p = krb5_gss_oid_array; p->length; p++) {
59 		if ((oid->length == p->length) &&
60 		    (memcmp(oid->elements, p->elements, p->length) == 0)) {
61 		        (void) KGSS_RELEASE_OID(&minor_status, &oid);
62 			return (gss_OID) p;
63 		}
64 	}
65 	return oid;
66 }
67 
68 krb5_error_code
69 krb5_gss_ser_init (krb5_context context)
70 {
71     krb5_error_code code;
72     static krb5_error_code (KRB5_CALLCONV *const fns[])(krb5_context) = {
73 	krb5_ser_auth_context_init,
74 #ifndef _KERNEL
75 	krb5_ser_context_init,
76 	krb5_ser_ccache_init, krb5_ser_rcache_init, krb5_ser_keytab_init,
77 #endif
78     };
79     int i;
80 
81     for (i = 0; i < sizeof(fns)/sizeof(fns[0]); i++)
82 	if ((code = (fns[i])(context)) != 0)
83 	    return code;
84     return 0;
85 }
86 
87 OM_uint32
88 krb5_gss_import_sec_context(minor_status, interprocess_token, context_handle)
89     OM_uint32		*minor_status;
90     gss_buffer_t	interprocess_token;
91     gss_ctx_id_t	*context_handle;
92 {
93     krb5_context	context;
94     krb5_error_code	kret = 0;
95     size_t		blen;
96     krb5_gss_ctx_id_t	ctx;
97     krb5_octet		*ibp;
98 
99     /* This is a bit screwy.  We create a krb5 context because we need
100        one when calling the serialization code.  However, one of the
101        objects we're unpacking is a krb5 context, so when we finish,
102        we can throw this one away.  */
103     kret = KGSS_INIT_CONTEXT(&context);
104     if (kret) {
105 	*minor_status = kret;
106 	return GSS_S_FAILURE;
107     }
108 
109     kret = krb5_gss_ser_init(context);
110     if (kret) {
111 	krb5_free_context(context);
112 	*minor_status = kret;
113 	return GSS_S_FAILURE;
114     }
115 
116     /* Assume a tragic failure */
117     ctx = (krb5_gss_ctx_id_t) NULL;
118     *minor_status = 0;
119 
120     /* Internalize the context */
121     ibp = (krb5_octet *) interprocess_token->value;
122     blen = (size_t) interprocess_token->length;
123     kret = kg_ctx_internalize(context, (krb5_pointer *) &ctx, &ibp, &blen);
124     /*
125      * SUNW15resync
126      *
127      *    krb5_free_context(context);
128      * Previous versions of MIT(1.2ish)/Solaris did not serialize the
129      * k5_context but MIT 1.5 does.  But we don't need all the userspace
130      * junk in the kernel so we continue to not serialize it.
131      * So we keep this context live here (see it's use in kg_ctx_internalize)
132      * and it will get freed by delete_sec_context.
133      */
134     if (kret) {
135        krb5_free_context(context);
136        *minor_status = (OM_uint32) kret;
137        return(GSS_S_FAILURE);
138     }
139 
140     /* intern the context handle */
141     if (! kg_save_ctx_id((gss_ctx_id_t) ctx)) {
142        (void)krb5_gss_delete_sec_context(minor_status,
143 					 (gss_ctx_id_t *) &ctx, NULL
144 #ifdef _KERNEL
145  					,0  /* gssd_ctx_verifier */
146 #endif
147 					);
148        *minor_status = (OM_uint32) G_VALIDATE_FAILED;
149        return(GSS_S_FAILURE);
150     }
151 
152     ctx->mech_used = krb5_gss_convert_static_mech_oid(ctx->mech_used);
153 
154     *context_handle = (gss_ctx_id_t) ctx;
155 
156     *minor_status = 0;
157     return (GSS_S_COMPLETE);
158 }
159