1/*-
2 * Copyright (c) 2005 Doug Rabson
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 *	$FreeBSD$
27 */
28
29#include <gssapi/gssapi.h>
30#include <stdlib.h>
31#include <string.h>
32#include <errno.h>
33
34#include "mech_switch.h"
35#include "name.h"
36#include "cred.h"
37#include "context.h"
38#include "utils.h"
39
40static gss_cred_id_t
41_gss_mech_cred_find(gss_cred_id_t cred_handle, gss_OID mech_type)
42{
43	struct _gss_cred *cred = (struct _gss_cred *)cred_handle;
44	struct _gss_mechanism_cred *mc;
45
46	if (cred == NULL)
47		return GSS_C_NO_CREDENTIAL;
48
49	SLIST_FOREACH(mc, &cred->gc_mc, gmc_link) {
50		if (gss_oid_equal(mech_type, mc->gmc_mech_oid))
51			return mc->gmc_cred;
52	}
53	return GSS_C_NO_CREDENTIAL;
54}
55
56OM_uint32
57gss_init_sec_context(OM_uint32 * minor_status,
58    const gss_cred_id_t initiator_cred_handle,
59    gss_ctx_id_t * context_handle,
60    const gss_name_t target_name,
61    const gss_OID input_mech_type,
62    OM_uint32 req_flags,
63    OM_uint32 time_req,
64    const gss_channel_bindings_t input_chan_bindings,
65    const gss_buffer_t input_token,
66    gss_OID * actual_mech_type,
67    gss_buffer_t output_token,
68    OM_uint32 * ret_flags,
69    OM_uint32 * time_rec)
70{
71	OM_uint32 major_status;
72	struct _gss_mech_switch *m;
73	struct _gss_name *name = (struct _gss_name *) target_name;
74	struct _gss_mechanism_name *mn;
75	struct _gss_context *ctx = (struct _gss_context *) *context_handle;
76	gss_cred_id_t cred_handle;
77	int allocated_ctx;
78	gss_OID mech_type = input_mech_type;
79
80	*minor_status = 0;
81
82	_gss_buffer_zero(output_token);
83	if (actual_mech_type)
84		*actual_mech_type = GSS_C_NO_OID;
85	if (ret_flags)
86		*ret_flags = 0;
87	if (time_rec)
88		*time_rec = 0;
89
90	/*
91	 * If we haven't allocated a context yet, do so now and lookup
92	 * the mechanism switch table. If we have one already, make
93	 * sure we use the same mechanism switch as before.
94	 */
95	if (!ctx) {
96		if (mech_type == GSS_C_NO_OID) {
97			_gss_load_mech();
98			if (_gss_mech_oids == GSS_C_NO_OID_SET
99			    || _gss_mech_oids->count == 0)
100				return (GSS_S_BAD_MECH);
101			mech_type = &_gss_mech_oids->elements[0];
102		}
103
104		ctx = malloc(sizeof(struct _gss_context));
105		if (!ctx) {
106			*minor_status = ENOMEM;
107			return (GSS_S_FAILURE);
108		}
109		memset(ctx, 0, sizeof(struct _gss_context));
110		m = ctx->gc_mech = _gss_find_mech_switch(mech_type);
111		if (!m) {
112			free(ctx);
113			return (GSS_S_BAD_MECH);
114		}
115		allocated_ctx = 1;
116	} else {
117		m = ctx->gc_mech;
118		mech_type = &ctx->gc_mech->gm_mech_oid;
119		allocated_ctx = 0;
120	}
121
122	/*
123	 * Find the MN for this mechanism.
124	 */
125	major_status = _gss_find_mn(minor_status, name, mech_type, &mn);
126	if (major_status != GSS_S_COMPLETE) {
127		if (allocated_ctx)
128			free(ctx);
129		return (major_status);
130	}
131
132	/*
133	 * If we have a cred, find the cred for this mechanism.
134	 */
135	cred_handle = _gss_mech_cred_find(initiator_cred_handle, mech_type);
136
137	major_status = m->gm_init_sec_context(minor_status,
138	    cred_handle,
139	    &ctx->gc_ctx,
140	    mn->gmn_name,
141	    mech_type,
142	    req_flags,
143	    time_req,
144	    input_chan_bindings,
145	    input_token,
146	    actual_mech_type,
147	    output_token,
148	    ret_flags,
149	    time_rec);
150
151	if (major_status != GSS_S_COMPLETE
152	    && major_status != GSS_S_CONTINUE_NEEDED) {
153		if (allocated_ctx)
154			free(ctx);
155		_gss_buffer_zero(output_token);
156		_gss_mg_error(m, major_status, *minor_status);
157	} else {
158		*context_handle = (gss_ctx_id_t) ctx;
159	}
160
161	return (major_status);
162}
163