1/*	$NetBSD: creds.c,v 1.5 2023/06/19 21:41:43 christos Exp $	*/
2
3/*
4 * Copyright (c) 2006 Kungliga Tekniska H��gskolan
5 * (Royal Institute of Technology, Stockholm, Sweden).
6 * All rights reserved.
7 *
8 * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 *
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions and the following disclaimer.
16 *
17 * 2. Redistributions in binary form must reproduce the above copyright
18 *    notice, this list of conditions and the following disclaimer in the
19 *    documentation and/or other materials provided with the distribution.
20 *
21 * 3. Neither the name of the Institute nor the names of its contributors
22 *    may be used to endorse or promote products derived from this software
23 *    without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 */
37
38#include "ntlm.h"
39
40OM_uint32 GSSAPI_CALLCONV
41_gss_ntlm_inquire_cred
42           (OM_uint32 * minor_status,
43            gss_const_cred_id_t cred_handle,
44            gss_name_t * name,
45            OM_uint32 * lifetime,
46            gss_cred_usage_t * cred_usage,
47            gss_OID_set * mechanisms
48           )
49{
50    OM_uint32 ret, junk;
51
52    *minor_status = 0;
53
54    if (cred_handle == NULL)
55	return GSS_S_NO_CRED;
56
57    if (name) {
58	ntlm_name n = calloc(1, sizeof(*n));
59	ntlm_cred c = (ntlm_cred)cred_handle;
60	if (n) {
61	    n->user = strdup(c->username);
62	    n->domain = strdup(c->domain);
63	}
64	if (n == NULL || n->user == NULL || n->domain == NULL) {
65	    if (n) {
66		free(n->user);
67		free(n->domain);
68		free(n);
69	    }
70	    *minor_status = ENOMEM;
71	    return GSS_S_FAILURE;
72	}
73	*name = (gss_name_t)n;
74    }
75    if (lifetime)
76	*lifetime = GSS_C_INDEFINITE;
77    if (cred_usage)
78	*cred_usage = 0;
79    if (mechanisms)
80	*mechanisms = GSS_C_NO_OID_SET;
81
82    if (cred_handle == GSS_C_NO_CREDENTIAL)
83	return GSS_S_NO_CRED;
84
85    if (mechanisms) {
86        ret = gss_create_empty_oid_set(minor_status, mechanisms);
87        if (ret)
88	    goto out;
89	ret = gss_add_oid_set_member(minor_status,
90				     GSS_NTLM_MECHANISM,
91				     mechanisms);
92        if (ret)
93	    goto out;
94    }
95
96    return GSS_S_COMPLETE;
97out:
98    gss_release_oid_set(&junk, mechanisms);
99    return ret;
100}
101
102#ifdef HAVE_KCM
103static OM_uint32
104_gss_ntlm_destroy_kcm_cred(gss_cred_id_t *cred_handle)
105{
106    krb5_storage *request, *response;
107    krb5_data response_data;
108    krb5_context context;
109    krb5_error_code ret;
110    ntlm_cred cred;
111
112    cred = (ntlm_cred)*cred_handle;
113
114    ret = krb5_init_context(&context);
115    if (ret)
116        return ret;
117
118    ret = krb5_kcm_storage_request(context, KCM_OP_DEL_NTLM_CRED, &request);
119    if (ret)
120	goto out;
121
122    ret = krb5_store_stringz(request, cred->username);
123    if (ret)
124	goto out;
125
126    ret = krb5_store_stringz(request, cred->domain);
127    if (ret)
128	goto out;
129
130    ret = krb5_kcm_call(context, request, &response, &response_data);
131    if (ret)
132	goto out;
133
134    krb5_storage_free(request);
135    krb5_storage_free(response);
136    krb5_data_free(&response_data);
137
138 out:
139    krb5_free_context(context);
140
141    return ret;
142}
143#endif /* HAVE_KCM */
144
145OM_uint32 GSSAPI_CALLCONV
146_gss_ntlm_destroy_cred(OM_uint32 *minor_status,
147		       gss_cred_id_t *cred_handle)
148{
149#ifdef HAVE_KCM
150    krb5_error_code ret;
151#endif
152
153    if (cred_handle == NULL || *cred_handle == GSS_C_NO_CREDENTIAL)
154	return GSS_S_COMPLETE;
155
156#ifdef HAVE_KCM
157    ret = _gss_ntlm_destroy_kcm_cred(cred_handle);
158    if (ret) {
159	*minor_status = ret;
160	return GSS_S_FAILURE;
161    }
162#endif
163
164    return _gss_ntlm_release_cred(minor_status, cred_handle);
165}
166