1/* 2 * Copyright (c) 1997 - 2005 Kungliga Tekniska H��gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include "krb5_locl.h" 35 36/** 37 * Free content of krb5_creds. 38 * 39 * @param context Kerberos 5 context. 40 * @param c krb5_creds to free. 41 * 42 * @return Returns 0 to indicate success. Otherwise an kerberos et 43 * error code is returned, see krb5_get_error_message(). 44 * 45 * @ingroup krb5 46 */ 47 48krb5_error_code KRB5_LIB_FUNCTION 49krb5_free_cred_contents (krb5_context context, krb5_creds *c) 50{ 51 krb5_free_principal (context, c->client); 52 c->client = NULL; 53 krb5_free_principal (context, c->server); 54 c->server = NULL; 55 krb5_free_keyblock_contents (context, &c->session); 56 krb5_data_free (&c->ticket); 57 krb5_data_free (&c->second_ticket); 58 free_AuthorizationData (&c->authdata); 59 krb5_free_addresses (context, &c->addresses); 60 memset(c, 0, sizeof(*c)); 61 return 0; 62} 63 64/** 65 * Copy content of krb5_creds. 66 * 67 * @param context Kerberos 5 context. 68 * @param incred source credential 69 * @param c destination credential, free with krb5_free_cred_contents(). 70 * 71 * @return Returns 0 to indicate success. Otherwise an kerberos et 72 * error code is returned, see krb5_get_error_message(). 73 * 74 * @ingroup krb5 75 */ 76 77krb5_error_code KRB5_LIB_FUNCTION 78krb5_copy_creds_contents (krb5_context context, 79 const krb5_creds *incred, 80 krb5_creds *c) 81{ 82 krb5_error_code ret; 83 84 memset(c, 0, sizeof(*c)); 85 ret = krb5_copy_principal (context, incred->client, &c->client); 86 if (ret) 87 goto fail; 88 ret = krb5_copy_principal (context, incred->server, &c->server); 89 if (ret) 90 goto fail; 91 ret = krb5_copy_keyblock_contents (context, &incred->session, &c->session); 92 if (ret) 93 goto fail; 94 c->times = incred->times; 95 ret = krb5_data_copy (&c->ticket, 96 incred->ticket.data, 97 incred->ticket.length); 98 if (ret) 99 goto fail; 100 ret = krb5_data_copy (&c->second_ticket, 101 incred->second_ticket.data, 102 incred->second_ticket.length); 103 if (ret) 104 goto fail; 105 ret = copy_AuthorizationData(&incred->authdata, &c->authdata); 106 if (ret) 107 goto fail; 108 ret = krb5_copy_addresses (context, 109 &incred->addresses, 110 &c->addresses); 111 if (ret) 112 goto fail; 113 c->flags = incred->flags; 114 return 0; 115 116fail: 117 krb5_free_cred_contents (context, c); 118 return ret; 119} 120 121/** 122 * Copy krb5_creds. 123 * 124 * @param context Kerberos 5 context. 125 * @param incred source credential 126 * @param outcred destination credential, free with krb5_free_creds(). 127 * 128 * @return Returns 0 to indicate success. Otherwise an kerberos et 129 * error code is returned, see krb5_get_error_message(). 130 * 131 * @ingroup krb5 132 */ 133 134krb5_error_code KRB5_LIB_FUNCTION 135krb5_copy_creds (krb5_context context, 136 const krb5_creds *incred, 137 krb5_creds **outcred) 138{ 139 krb5_creds *c; 140 141 c = malloc (sizeof (*c)); 142 if (c == NULL) { 143 krb5_set_error_message (context, ENOMEM, 144 N_("malloc: out of memory", "")); 145 return ENOMEM; 146 } 147 memset (c, 0, sizeof(*c)); 148 *outcred = c; 149 return krb5_copy_creds_contents (context, incred, c); 150} 151 152/** 153 * Free krb5_creds. 154 * 155 * @param context Kerberos 5 context. 156 * @param c krb5_creds to free. 157 * 158 * @return Returns 0 to indicate success. Otherwise an kerberos et 159 * error code is returned, see krb5_get_error_message(). 160 * 161 * @ingroup krb5 162 */ 163 164krb5_error_code KRB5_LIB_FUNCTION 165krb5_free_creds (krb5_context context, krb5_creds *c) 166{ 167 krb5_free_cred_contents (context, c); 168 free (c); 169 return 0; 170} 171 172/* XXX this do not belong here */ 173static krb5_boolean 174krb5_times_equal(const krb5_times *a, const krb5_times *b) 175{ 176 return a->starttime == b->starttime && 177 a->authtime == b->authtime && 178 a->endtime == b->endtime && 179 a->renew_till == b->renew_till; 180} 181 182/** 183 * Return TRUE if `mcreds' and `creds' are equal (`whichfields' 184 * determines what equal means). 185 * 186 * @param context Kerberos 5 context. 187 * @param whichfields which fields to compare. 188 * @param mcreds cred to compare with. 189 * @param creds cred to compare with. 190 * 191 * @return return TRUE if mcred and creds are equal, FALSE if not. 192 * 193 * @ingroup krb5 194 */ 195 196krb5_boolean KRB5_LIB_FUNCTION 197krb5_compare_creds(krb5_context context, krb5_flags whichfields, 198 const krb5_creds * mcreds, const krb5_creds * creds) 199{ 200 krb5_boolean match = TRUE; 201 202 if (match && mcreds->server) { 203 if (whichfields & (KRB5_TC_DONT_MATCH_REALM | KRB5_TC_MATCH_SRV_NAMEONLY)) 204 match = krb5_principal_compare_any_realm (context, mcreds->server, 205 creds->server); 206 else 207 match = krb5_principal_compare (context, mcreds->server, 208 creds->server); 209 } 210 211 if (match && mcreds->client) { 212 if(whichfields & KRB5_TC_DONT_MATCH_REALM) 213 match = krb5_principal_compare_any_realm (context, mcreds->client, 214 creds->client); 215 else 216 match = krb5_principal_compare (context, mcreds->client, 217 creds->client); 218 } 219 220 if (match && (whichfields & KRB5_TC_MATCH_KEYTYPE)) 221 match = mcreds->session.keytype == creds->session.keytype; 222 223 if (match && (whichfields & KRB5_TC_MATCH_FLAGS_EXACT)) 224 match = mcreds->flags.i == creds->flags.i; 225 226 if (match && (whichfields & KRB5_TC_MATCH_FLAGS)) 227 match = (creds->flags.i & mcreds->flags.i) == mcreds->flags.i; 228 229 if (match && (whichfields & KRB5_TC_MATCH_TIMES_EXACT)) 230 match = krb5_times_equal(&mcreds->times, &creds->times); 231 232 if (match && (whichfields & KRB5_TC_MATCH_TIMES)) 233 /* compare only expiration times */ 234 match = (mcreds->times.renew_till <= creds->times.renew_till) && 235 (mcreds->times.endtime <= creds->times.endtime); 236 237 if (match && (whichfields & KRB5_TC_MATCH_AUTHDATA)) { 238 unsigned int i; 239 if(mcreds->authdata.len != creds->authdata.len) 240 match = FALSE; 241 else 242 for(i = 0; match && i < mcreds->authdata.len; i++) 243 match = (mcreds->authdata.val[i].ad_type == 244 creds->authdata.val[i].ad_type) && 245 (krb5_data_cmp(&mcreds->authdata.val[i].ad_data, 246 &creds->authdata.val[i].ad_data) == 0); 247 } 248 if (match && (whichfields & KRB5_TC_MATCH_2ND_TKT)) 249 match = (krb5_data_cmp(&mcreds->second_ticket, &creds->second_ticket) == 0); 250 251 if (match && (whichfields & KRB5_TC_MATCH_IS_SKEY)) 252 match = ((mcreds->second_ticket.length == 0) == 253 (creds->second_ticket.length == 0)); 254 255 return match; 256} 257 258/** 259 * Returns the ticket flags for the credentials in creds. 260 * See also krb5_ticket_get_flags(). 261 * 262 * @param creds credential to get ticket flags from 263 * 264 * @return ticket flags 265 * 266 * @ingroup krb5 267 */ 268 269unsigned long 270krb5_creds_get_ticket_flags(krb5_creds *creds) 271{ 272 return TicketFlags2int(creds->flags.b); 273} 274