1/* $NetBSD: creds.c,v 1.2 2017/01/28 21:31:49 christos Exp $ */ 2 3/* 4 * Copyright (c) 1997 - 2005 Kungliga Tekniska H��gskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36#include "krb5_locl.h" 37 38/** 39 * Free content of krb5_creds. 40 * 41 * @param context Kerberos 5 context. 42 * @param c krb5_creds to free. 43 * 44 * @return Returns 0 to indicate success. Otherwise an kerberos et 45 * error code is returned, see krb5_get_error_message(). 46 * 47 * @ingroup krb5 48 */ 49 50KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 51krb5_free_cred_contents (krb5_context context, krb5_creds *c) 52{ 53 krb5_free_principal (context, c->client); 54 c->client = NULL; 55 krb5_free_principal (context, c->server); 56 c->server = NULL; 57 krb5_free_keyblock_contents (context, &c->session); 58 krb5_data_free (&c->ticket); 59 krb5_data_free (&c->second_ticket); 60 free_AuthorizationData (&c->authdata); 61 krb5_free_addresses (context, &c->addresses); 62 memset(c, 0, sizeof(*c)); 63 return 0; 64} 65 66/** 67 * Copy content of krb5_creds. 68 * 69 * @param context Kerberos 5 context. 70 * @param incred source credential 71 * @param c destination credential, free with krb5_free_cred_contents(). 72 * 73 * @return Returns 0 to indicate success. Otherwise an kerberos et 74 * error code is returned, see krb5_get_error_message(). 75 * 76 * @ingroup krb5 77 */ 78 79KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 80krb5_copy_creds_contents (krb5_context context, 81 const krb5_creds *incred, 82 krb5_creds *c) 83{ 84 krb5_error_code ret; 85 86 memset(c, 0, sizeof(*c)); 87 ret = krb5_copy_principal (context, incred->client, &c->client); 88 if (ret) 89 goto fail; 90 ret = krb5_copy_principal (context, incred->server, &c->server); 91 if (ret) 92 goto fail; 93 ret = krb5_copy_keyblock_contents (context, &incred->session, &c->session); 94 if (ret) 95 goto fail; 96 c->times = incred->times; 97 ret = krb5_data_copy (&c->ticket, 98 incred->ticket.data, 99 incred->ticket.length); 100 if (ret) 101 goto fail; 102 ret = krb5_data_copy (&c->second_ticket, 103 incred->second_ticket.data, 104 incred->second_ticket.length); 105 if (ret) 106 goto fail; 107 ret = copy_AuthorizationData(&incred->authdata, &c->authdata); 108 if (ret) 109 goto fail; 110 ret = krb5_copy_addresses (context, 111 &incred->addresses, 112 &c->addresses); 113 if (ret) 114 goto fail; 115 c->flags = incred->flags; 116 return 0; 117 118fail: 119 krb5_free_cred_contents (context, c); 120 return ret; 121} 122 123/** 124 * Copy krb5_creds. 125 * 126 * @param context Kerberos 5 context. 127 * @param incred source credential 128 * @param outcred destination credential, free with krb5_free_creds(). 129 * 130 * @return Returns 0 to indicate success. Otherwise an kerberos et 131 * error code is returned, see krb5_get_error_message(). 132 * 133 * @ingroup krb5 134 */ 135 136KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 137krb5_copy_creds (krb5_context context, 138 const krb5_creds *incred, 139 krb5_creds **outcred) 140{ 141 krb5_creds *c; 142 143 c = calloc(1, sizeof(*c)); 144 if (c == NULL) 145 return krb5_enomem(context); 146 *outcred = c; 147 return krb5_copy_creds_contents (context, incred, c); 148} 149 150/** 151 * Free krb5_creds. 152 * 153 * @param context Kerberos 5 context. 154 * @param c krb5_creds to free. 155 * 156 * @return Returns 0 to indicate success. Otherwise an kerberos et 157 * error code is returned, see krb5_get_error_message(). 158 * 159 * @ingroup krb5 160 */ 161 162KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 163krb5_free_creds (krb5_context context, krb5_creds *c) 164{ 165 if (c != NULL) 166 krb5_free_cred_contents(context, c); 167 free(c); 168 return 0; 169} 170 171/* XXX this do not belong here */ 172static krb5_boolean 173krb5_times_equal(const krb5_times *a, const krb5_times *b) 174{ 175 return a->starttime == b->starttime && 176 a->authtime == b->authtime && 177 a->endtime == b->endtime && 178 a->renew_till == b->renew_till; 179} 180 181/** 182 * Return TRUE if `mcreds' and `creds' are equal (`whichfields' 183 * determines what equal means). 184 * 185 * 186 * The following flags, set in whichfields affects the comparison: 187 * - KRB5_TC_MATCH_SRV_NAMEONLY Consider all realms equal when comparing the service principal. 188 * - KRB5_TC_MATCH_KEYTYPE Compare enctypes. 189 * - KRB5_TC_MATCH_FLAGS_EXACT Make sure that the ticket flags are identical. 190 * - KRB5_TC_MATCH_FLAGS Make sure that all ticket flags set in mcreds are also present in creds . 191 * - KRB5_TC_MATCH_TIMES_EXACT Compares the ticket times exactly. 192 * - KRB5_TC_MATCH_TIMES Compares only the expiration times of the creds. 193 * - KRB5_TC_MATCH_AUTHDATA Compares the authdata fields. 194 * - KRB5_TC_MATCH_2ND_TKT Compares the second tickets (used by user-to-user authentication). 195 * - KRB5_TC_MATCH_IS_SKEY Compares the existance of the second ticket. 196 * 197 * @param context Kerberos 5 context. 198 * @param whichfields which fields to compare. 199 * @param mcreds cred to compare with. 200 * @param creds cred to compare with. 201 * 202 * @return return TRUE if mcred and creds are equal, FALSE if not. 203 * 204 * @ingroup krb5 205 */ 206 207KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL 208krb5_compare_creds(krb5_context context, krb5_flags whichfields, 209 const krb5_creds * mcreds, const krb5_creds * creds) 210{ 211 krb5_boolean match = TRUE; 212 213 if (match && mcreds->server) { 214 if (whichfields & (KRB5_TC_DONT_MATCH_REALM | KRB5_TC_MATCH_SRV_NAMEONLY)) 215 match = krb5_principal_compare_any_realm (context, mcreds->server, 216 creds->server); 217 else 218 match = krb5_principal_compare (context, mcreds->server, 219 creds->server); 220 } 221 222 if (match && mcreds->client) { 223 if(whichfields & KRB5_TC_DONT_MATCH_REALM) 224 match = krb5_principal_compare_any_realm (context, mcreds->client, 225 creds->client); 226 else 227 match = krb5_principal_compare (context, mcreds->client, 228 creds->client); 229 } 230 231 if (match && (whichfields & KRB5_TC_MATCH_KEYTYPE)) 232 match = mcreds->session.keytype == creds->session.keytype; 233 234 if (match && (whichfields & KRB5_TC_MATCH_FLAGS_EXACT)) 235 match = mcreds->flags.i == creds->flags.i; 236 237 if (match && (whichfields & KRB5_TC_MATCH_FLAGS)) 238 match = (creds->flags.i & mcreds->flags.i) == mcreds->flags.i; 239 240 if (match && (whichfields & KRB5_TC_MATCH_TIMES_EXACT)) 241 match = krb5_times_equal(&mcreds->times, &creds->times); 242 243 if (match && (whichfields & KRB5_TC_MATCH_TIMES)) 244 /* compare only expiration times */ 245 match = (mcreds->times.renew_till <= creds->times.renew_till) && 246 (mcreds->times.endtime <= creds->times.endtime); 247 248 if (match && (whichfields & KRB5_TC_MATCH_AUTHDATA)) { 249 unsigned int i; 250 if(mcreds->authdata.len != creds->authdata.len) 251 match = FALSE; 252 else 253 for(i = 0; match && i < mcreds->authdata.len; i++) 254 match = (mcreds->authdata.val[i].ad_type == 255 creds->authdata.val[i].ad_type) && 256 (krb5_data_cmp(&mcreds->authdata.val[i].ad_data, 257 &creds->authdata.val[i].ad_data) == 0); 258 } 259 if (match && (whichfields & KRB5_TC_MATCH_2ND_TKT)) 260 match = (krb5_data_cmp(&mcreds->second_ticket, &creds->second_ticket) == 0); 261 262 if (match && (whichfields & KRB5_TC_MATCH_IS_SKEY)) 263 match = ((mcreds->second_ticket.length == 0) == 264 (creds->second_ticket.length == 0)); 265 266 return match; 267} 268 269/** 270 * Returns the ticket flags for the credentials in creds. 271 * See also krb5_ticket_get_flags(). 272 * 273 * @param creds credential to get ticket flags from 274 * 275 * @return ticket flags 276 * 277 * @ingroup krb5 278 */ 279 280KRB5_LIB_FUNCTION unsigned long KRB5_LIB_CALL 281krb5_creds_get_ticket_flags(krb5_creds *creds) 282{ 283 return TicketFlags2int(creds->flags.b); 284} 285