creds.c revision 1.1.1.2
1/* $NetBSD: creds.c,v 1.1.1.2 2014/04/24 12:45:49 pettai Exp $ */ 2 3/* 4 * Copyright (c) 1997 - 2005 Kungliga Tekniska H��gskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36#include "krb5_locl.h" 37 38/** 39 * Free content of krb5_creds. 40 * 41 * @param context Kerberos 5 context. 42 * @param c krb5_creds to free. 43 * 44 * @return Returns 0 to indicate success. Otherwise an kerberos et 45 * error code is returned, see krb5_get_error_message(). 46 * 47 * @ingroup krb5 48 */ 49 50KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 51krb5_free_cred_contents (krb5_context context, krb5_creds *c) 52{ 53 krb5_free_principal (context, c->client); 54 c->client = NULL; 55 krb5_free_principal (context, c->server); 56 c->server = NULL; 57 krb5_free_keyblock_contents (context, &c->session); 58 krb5_data_free (&c->ticket); 59 krb5_data_free (&c->second_ticket); 60 free_AuthorizationData (&c->authdata); 61 krb5_free_addresses (context, &c->addresses); 62 memset(c, 0, sizeof(*c)); 63 return 0; 64} 65 66/** 67 * Copy content of krb5_creds. 68 * 69 * @param context Kerberos 5 context. 70 * @param incred source credential 71 * @param c destination credential, free with krb5_free_cred_contents(). 72 * 73 * @return Returns 0 to indicate success. Otherwise an kerberos et 74 * error code is returned, see krb5_get_error_message(). 75 * 76 * @ingroup krb5 77 */ 78 79KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 80krb5_copy_creds_contents (krb5_context context, 81 const krb5_creds *incred, 82 krb5_creds *c) 83{ 84 krb5_error_code ret; 85 86 memset(c, 0, sizeof(*c)); 87 ret = krb5_copy_principal (context, incred->client, &c->client); 88 if (ret) 89 goto fail; 90 ret = krb5_copy_principal (context, incred->server, &c->server); 91 if (ret) 92 goto fail; 93 ret = krb5_copy_keyblock_contents (context, &incred->session, &c->session); 94 if (ret) 95 goto fail; 96 c->times = incred->times; 97 ret = krb5_data_copy (&c->ticket, 98 incred->ticket.data, 99 incred->ticket.length); 100 if (ret) 101 goto fail; 102 ret = krb5_data_copy (&c->second_ticket, 103 incred->second_ticket.data, 104 incred->second_ticket.length); 105 if (ret) 106 goto fail; 107 ret = copy_AuthorizationData(&incred->authdata, &c->authdata); 108 if (ret) 109 goto fail; 110 ret = krb5_copy_addresses (context, 111 &incred->addresses, 112 &c->addresses); 113 if (ret) 114 goto fail; 115 c->flags = incred->flags; 116 return 0; 117 118fail: 119 krb5_free_cred_contents (context, c); 120 return ret; 121} 122 123/** 124 * Copy krb5_creds. 125 * 126 * @param context Kerberos 5 context. 127 * @param incred source credential 128 * @param outcred destination credential, free with krb5_free_creds(). 129 * 130 * @return Returns 0 to indicate success. Otherwise an kerberos et 131 * error code is returned, see krb5_get_error_message(). 132 * 133 * @ingroup krb5 134 */ 135 136KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 137krb5_copy_creds (krb5_context context, 138 const krb5_creds *incred, 139 krb5_creds **outcred) 140{ 141 krb5_creds *c; 142 143 c = malloc (sizeof (*c)); 144 if (c == NULL) { 145 krb5_set_error_message (context, ENOMEM, 146 N_("malloc: out of memory", "")); 147 return ENOMEM; 148 } 149 memset (c, 0, sizeof(*c)); 150 *outcred = c; 151 return krb5_copy_creds_contents (context, incred, c); 152} 153 154/** 155 * Free krb5_creds. 156 * 157 * @param context Kerberos 5 context. 158 * @param c krb5_creds to free. 159 * 160 * @return Returns 0 to indicate success. Otherwise an kerberos et 161 * error code is returned, see krb5_get_error_message(). 162 * 163 * @ingroup krb5 164 */ 165 166KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL 167krb5_free_creds (krb5_context context, krb5_creds *c) 168{ 169 krb5_free_cred_contents (context, c); 170 free (c); 171 return 0; 172} 173 174/* XXX this do not belong here */ 175static krb5_boolean 176krb5_times_equal(const krb5_times *a, const krb5_times *b) 177{ 178 return a->starttime == b->starttime && 179 a->authtime == b->authtime && 180 a->endtime == b->endtime && 181 a->renew_till == b->renew_till; 182} 183 184/** 185 * Return TRUE if `mcreds' and `creds' are equal (`whichfields' 186 * determines what equal means). 187 * 188 * 189 * The following flags, set in whichfields affects the comparison: 190 * - KRB5_TC_MATCH_SRV_NAMEONLY Consider all realms equal when comparing the service principal. 191 * - KRB5_TC_MATCH_KEYTYPE Compare enctypes. 192 * - KRB5_TC_MATCH_FLAGS_EXACT Make sure that the ticket flags are identical. 193 * - KRB5_TC_MATCH_FLAGS Make sure that all ticket flags set in mcreds are also present in creds . 194 * - KRB5_TC_MATCH_TIMES_EXACT Compares the ticket times exactly. 195 * - KRB5_TC_MATCH_TIMES Compares only the expiration times of the creds. 196 * - KRB5_TC_MATCH_AUTHDATA Compares the authdata fields. 197 * - KRB5_TC_MATCH_2ND_TKT Compares the second tickets (used by user-to-user authentication). 198 * - KRB5_TC_MATCH_IS_SKEY Compares the existance of the second ticket. 199 * 200 * @param context Kerberos 5 context. 201 * @param whichfields which fields to compare. 202 * @param mcreds cred to compare with. 203 * @param creds cred to compare with. 204 * 205 * @return return TRUE if mcred and creds are equal, FALSE if not. 206 * 207 * @ingroup krb5 208 */ 209 210KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL 211krb5_compare_creds(krb5_context context, krb5_flags whichfields, 212 const krb5_creds * mcreds, const krb5_creds * creds) 213{ 214 krb5_boolean match = TRUE; 215 216 if (match && mcreds->server) { 217 if (whichfields & (KRB5_TC_DONT_MATCH_REALM | KRB5_TC_MATCH_SRV_NAMEONLY)) 218 match = krb5_principal_compare_any_realm (context, mcreds->server, 219 creds->server); 220 else 221 match = krb5_principal_compare (context, mcreds->server, 222 creds->server); 223 } 224 225 if (match && mcreds->client) { 226 if(whichfields & KRB5_TC_DONT_MATCH_REALM) 227 match = krb5_principal_compare_any_realm (context, mcreds->client, 228 creds->client); 229 else 230 match = krb5_principal_compare (context, mcreds->client, 231 creds->client); 232 } 233 234 if (match && (whichfields & KRB5_TC_MATCH_KEYTYPE)) 235 match = mcreds->session.keytype == creds->session.keytype; 236 237 if (match && (whichfields & KRB5_TC_MATCH_FLAGS_EXACT)) 238 match = mcreds->flags.i == creds->flags.i; 239 240 if (match && (whichfields & KRB5_TC_MATCH_FLAGS)) 241 match = (creds->flags.i & mcreds->flags.i) == mcreds->flags.i; 242 243 if (match && (whichfields & KRB5_TC_MATCH_TIMES_EXACT)) 244 match = krb5_times_equal(&mcreds->times, &creds->times); 245 246 if (match && (whichfields & KRB5_TC_MATCH_TIMES)) 247 /* compare only expiration times */ 248 match = (mcreds->times.renew_till <= creds->times.renew_till) && 249 (mcreds->times.endtime <= creds->times.endtime); 250 251 if (match && (whichfields & KRB5_TC_MATCH_AUTHDATA)) { 252 unsigned int i; 253 if(mcreds->authdata.len != creds->authdata.len) 254 match = FALSE; 255 else 256 for(i = 0; match && i < mcreds->authdata.len; i++) 257 match = (mcreds->authdata.val[i].ad_type == 258 creds->authdata.val[i].ad_type) && 259 (krb5_data_cmp(&mcreds->authdata.val[i].ad_data, 260 &creds->authdata.val[i].ad_data) == 0); 261 } 262 if (match && (whichfields & KRB5_TC_MATCH_2ND_TKT)) 263 match = (krb5_data_cmp(&mcreds->second_ticket, &creds->second_ticket) == 0); 264 265 if (match && (whichfields & KRB5_TC_MATCH_IS_SKEY)) 266 match = ((mcreds->second_ticket.length == 0) == 267 (creds->second_ticket.length == 0)); 268 269 return match; 270} 271 272/** 273 * Returns the ticket flags for the credentials in creds. 274 * See also krb5_ticket_get_flags(). 275 * 276 * @param creds credential to get ticket flags from 277 * 278 * @return ticket flags 279 * 280 * @ingroup krb5 281 */ 282 283KRB5_LIB_FUNCTION unsigned long KRB5_LIB_CALL 284krb5_creds_get_ticket_flags(krb5_creds *creds) 285{ 286 return TicketFlags2int(creds->flags.b); 287} 288