From 2bf5903927f8d0fce42df1e544df7abbcabbe899 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Oct 25 2012 19:53:30 +0000 Subject: Implement cred related mechglue wrappers --- diff --git a/proxy/Makefile.am b/proxy/Makefile.am index 4274cef..c75f0c6 100644 --- a/proxy/Makefile.am +++ b/proxy/Makefile.am @@ -101,6 +101,8 @@ GP_RPCCLI_OBJ = \ src/client/gpm_wrap_size_limit.c \ src/client/gpm_common.c GP_MECHGLUE_OBJ = \ + src/mechglue/gpp_acquire_cred.c \ + src/mechglue/gpp_creds.c \ src/mechglue/gss_plugin.c dist_noinst_HEADERS = \ diff --git a/proxy/src/mechglue/gpp_acquire_cred.c b/proxy/src/mechglue/gpp_acquire_cred.c new file mode 100644 index 0000000..3f29014 --- /dev/null +++ b/proxy/src/mechglue/gpp_acquire_cred.c @@ -0,0 +1,326 @@ +/* + GSS-PROXY + + Copyright (C) 2012 Red Hat, Inc. + Copyright (C) 2012 Simo Sorce + + Permission is hereby granted, free of charge, to any person obtaining a + copy of this software and associated documentation files (the "Software"), + to deal in the Software without restriction, including without limitation + the rights to use, copy, modify, merge, publish, distribute, sublicense, + and/or sell copies of the Software, and to permit persons to whom the + Software is furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL + THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. +*/ + + +#include "gss_plugin.h" + +static OM_uint32 acquire_local(OM_uint32 *minor_status, + struct gpp_name_handle *name, + OM_uint32 time_req, + const gss_OID_set desired_mechs, + gss_cred_usage_t cred_usage, + struct gpp_cred_handle *out_cred_handle, + gss_OID_set *actual_mechs, + OM_uint32 *time_rec) +{ + gss_OID_set special_mechs = GSS_C_NO_OID_SET; + OM_uint32 maj, min; + + special_mechs = gpp_special_available_mechs(desired_mechs); + if (special_mechs == GSS_C_NO_OID_SET) { + maj = GSS_S_BAD_MECH; + min = 0; + goto done; + } + + if (name && name->remote && !name->local) { + maj = gpp_name_to_local(&min, name->remote, + name->mech_type, &name->local); + if (maj) { + goto done; + } + } + + maj = gss_acquire_cred(&min, + name ? name->local : NULL, + time_req, + special_mechs, + cred_usage, + &out_cred_handle->local, + actual_mechs, + time_rec); + +done: + *minor_status = min; + (void)gss_release_oid_set(&min, &special_mechs); + return maj; +} + +OM_uint32 gssi_acquire_cred(OM_uint32 *minor_status, + const gss_name_t desired_name, + OM_uint32 time_req, + const gss_OID_set desired_mechs, + gss_cred_usage_t cred_usage, + gss_cred_id_t *output_cred_handle, + gss_OID_set *actual_mechs, + OM_uint32 *time_rec) +{ + enum gpp_behavior behavior; + struct gpp_name_handle *name; + struct gpp_cred_handle *out_cred_handle = NULL; + OM_uint32 maj, min; + OM_uint32 tmaj, tmin; + + if (!output_cred_handle) { + *minor_status = gpp_map_error(EINVAL); + return GSS_S_FAILURE; + } + + tmaj = GSS_S_COMPLETE; + tmin = 0; + + out_cred_handle = calloc(1, sizeof(struct gpp_cred_handle)); + if (!out_cred_handle) { + maj = GSS_S_FAILURE; + min = ENOMEM; + goto done; + } + + name = (struct gpp_name_handle *)desired_name; + behavior = gpp_get_behavior(); + + /* See if we should try local first */ + if (behavior == GPP_LOCAL_ONLY || behavior == GPP_LOCAL_FIRST) { + + maj = acquire_local(&min, name, time_req, desired_mechs, cred_usage, + out_cred_handle, actual_mechs, time_rec); + + if (maj != GSS_S_NO_CRED || behavior != GPP_LOCAL_FIRST) { + goto done; + } + + /* not successful, save actual local error if remote fallback fails */ + tmaj = maj; + tmin = min; + } + + /* Then try with remote */ + if (behavior == GPP_REMOTE_ONLY || behavior == GPP_REMOTE_FIRST) { + + if (name && name->local && !name->remote) { + maj = gpp_local_to_name(&min, name->local, &name->remote); + if (maj) { + goto done; + } + } + + maj = gpm_acquire_cred(&min, + name ? name->remote : NULL, + time_req, + desired_mechs, + cred_usage, + &out_cred_handle->remote, + actual_mechs, + time_rec); + if (maj == GSS_S_COMPLETE || behavior == GPP_REMOTE_ONLY) { + goto done; + } + + /* So remote failed, but we can fallback to local, try that */ + maj = acquire_local(&min, name, time_req, desired_mechs, cred_usage, + out_cred_handle, actual_mechs, time_rec); + } + +done: + if (maj != GSS_S_COMPLETE && + maj != GSS_S_CONTINUE_NEEDED && + tmaj != GSS_S_COMPLETE) { + maj = tmaj; + min = tmin; + } + if (maj == GSS_S_COMPLETE) { + *output_cred_handle = (gss_cred_id_t)out_cred_handle; + } else { + free(out_cred_handle); + } + *minor_status = gpp_map_error(min); + return maj; +} + +OM_uint32 gssi_add_cred(OM_uint32 *minor_status, + const gss_cred_id_t input_cred_handle, + const gss_name_t desired_name, + const gss_OID desired_mech, + gss_cred_usage_t cred_usage, + OM_uint32 initiator_time_req, + OM_uint32 acceptor_time_req, + gss_cred_id_t *output_cred_handle, + gss_OID_set *actual_mechs, + OM_uint32 *initiator_time_rec, + OM_uint32 *acceptor_time_rec) +{ + gss_OID_set desired_mechs = GSS_C_NO_OID_SET; + OM_uint32 time_req, time_rec; + OM_uint32 maj, min; + + if (!output_cred_handle) { + return GSS_S_CALL_INACCESSIBLE_WRITE; + } + + if (desired_mech) { + maj = gss_create_empty_oid_set(&min, &desired_mechs); + if (maj != GSS_S_COMPLETE) { + *minor_status = gpp_map_error(min); + return maj; + } + maj = gss_add_oid_set_member(&min, desired_mech, &desired_mechs); + if (maj != GSS_S_COMPLETE) { + (void)gss_release_oid_set(&min, &desired_mechs); + *minor_status = gpp_map_error(min); + return maj; + } + } + + switch (cred_usage) { + case GSS_C_ACCEPT: + time_req = acceptor_time_req; + break; + case GSS_C_INITIATE: + time_req = initiator_time_req; + break; + case GSS_C_BOTH: + if (acceptor_time_req > initiator_time_req) { + time_req = acceptor_time_req; + } else { + time_req = initiator_time_req; + } + break; + default: + time_req = 0; + } + + maj = gssi_acquire_cred(minor_status, + desired_name, + time_req, + desired_mechs, + cred_usage, + output_cred_handle, + actual_mechs, + &time_rec); + if (maj == GSS_S_COMPLETE) { + if (acceptor_time_rec && + (cred_usage == GSS_C_ACCEPT || cred_usage == GSS_C_BOTH)) { + *acceptor_time_rec = time_rec; + } + if (initiator_time_rec && + (cred_usage == GSS_C_INITIATE || cred_usage == GSS_C_BOTH)) { + *initiator_time_rec = time_rec; + } + } + + (void)gss_release_oid_set(&min, &desired_mechs); + return maj; +} + +OM_uint32 gssi_acquire_cred_with_password(OM_uint32 *minor_status, + const gss_name_t desired_name, + const gss_buffer_t password, + OM_uint32 time_req, + const gss_OID_set desired_mechs, + gss_cred_usage_t cred_usage, + gss_cred_id_t *output_cred_handle, + gss_OID_set *actual_mechs, + OM_uint32 *time_rec) +{ + enum gpp_behavior behavior; + struct gpp_name_handle *name; + struct gpp_cred_handle *out_cred_handle; + gss_OID_set special_mechs; + OM_uint32 maj, min; + + name = (struct gpp_name_handle *)desired_name; + + if (!output_cred_handle) { + *minor_status = gpp_map_error(EINVAL); + return GSS_S_FAILURE; + } + + if (desired_mechs == GSS_C_NO_OID_SET) { + return GSS_S_CALL_INACCESSIBLE_READ; + } + + behavior = gpp_get_behavior(); + + out_cred_handle = calloc(1, sizeof(struct gpp_cred_handle)); + if (!out_cred_handle) { + *minor_status = gpp_map_error(ENOMEM); + return GSS_S_FAILURE; + } + + switch (behavior) { + case GPP_LOCAL_ONLY: + case GPP_LOCAL_FIRST: + case GPP_REMOTE_FIRST: + + /* re-enter the mechglue, using the special OIDs for skipping + * the use of the interposer */ + special_mechs = gpp_special_available_mechs(desired_mechs); + if (special_mechs == GSS_C_NO_OID_SET) { + return GSS_S_FAILURE; + } + + if (name && name->remote && !name->local) { + maj = gpp_name_to_local(&min, name->remote, + name->mech_type, &name->local); + if (maj) { + goto done; + } + } + + maj = gss_acquire_cred_with_password(&min, + name->local, + password, + time_req, + special_mechs, + cred_usage, + &out_cred_handle->local, + actual_mechs, + time_rec); + break; + /* fall through if we got no creds locally and we are in + * automatic mode */ + + case GPP_REMOTE_ONLY: + + /* FIXME: not currently available */ + return GSS_S_UNAVAILABLE; + + break; + + default: + maj = GSS_S_FAILURE; + min = EINVAL; + } + +done: + if (maj == GSS_S_COMPLETE) { + *output_cred_handle = (gss_cred_id_t)out_cred_handle; + } else { + free(out_cred_handle); + } + *minor_status = gpp_map_error(min); + (void)gss_release_oid_set(&min, &special_mechs); + return maj; +} diff --git a/proxy/src/mechglue/gpp_creds.c b/proxy/src/mechglue/gpp_creds.c new file mode 100644 index 0000000..f37fd18 --- /dev/null +++ b/proxy/src/mechglue/gpp_creds.c @@ -0,0 +1,431 @@ +/* + GSS-PROXY + + Copyright (C) 2012 Red Hat, Inc. + Copyright (C) 2012 Simo Sorce + + Permission is hereby granted, free of charge, to any person obtaining a + copy of this software and associated documentation files (the "Software"), + to deal in the Software without restriction, including without limitation + the rights to use, copy, modify, merge, publish, distribute, sublicense, + and/or sell copies of the Software, and to permit persons to whom the + Software is furnished to do so, subject to the following conditions: + + The above copyright notice and this permission notice shall be included in + all copies or substantial portions of the Software. + + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL + THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER + DEALINGS IN THE SOFTWARE. +*/ + +#include "gss_plugin.h" + +static OM_uint32 get_local_def_creds(OM_uint32 *minor_status, + struct gpp_name_handle *name, + gss_cred_usage_t cred_usage, + struct gpp_cred_handle *cred_handle) +{ + gss_OID_set interposed_mechs = GSS_C_NO_OID_SET; + gss_OID_set special_mechs = GSS_C_NO_OID_SET; + OM_uint32 maj, min; + + maj = GSS_S_FAILURE; + min = 0; + + interposed_mechs = gss_mech_interposer((gss_OID)&gssproxy_mech_interposer); + if (interposed_mechs == GSS_C_NO_OID_SET) { + goto done; + } + special_mechs = gpp_special_available_mechs(interposed_mechs); + if (special_mechs == GSS_C_NO_OID_SET) { + goto done; + } + + maj = gss_acquire_cred(&min, name ? name->local : NULL, 0, special_mechs, + cred_usage, &cred_handle->local, NULL, NULL); +done: + *minor_status = min; + (void)gss_release_oid_set(&min, &special_mechs); + (void)gss_release_oid_set(&min, &interposed_mechs); + return maj; +} + +OM_uint32 gppint_get_def_creds(OM_uint32 *minor_status, + enum gpp_behavior behavior, + struct gpp_name_handle *name, + gss_cred_usage_t cred_usage, + struct gpp_cred_handle **cred_handle) +{ + struct gpp_cred_handle *cred; + OM_uint32 tmaj, tmin; + OM_uint32 maj, min; + + cred = calloc(1, sizeof(struct gpp_cred_handle)); + if (!cred) { + *minor_status = 0; + return GSS_S_FAILURE; + } + + tmaj = GSS_S_COMPLETE; + tmin = 0; + + /* See if we should try local first */ + if (behavior == GPP_LOCAL_ONLY || behavior == GPP_LOCAL_FIRST) { + + maj = get_local_def_creds(&min, name, cred_usage, cred); + if (maj != GSS_S_NO_CRED || behavior != GPP_LOCAL_FIRST) { + goto done; + } + + /* not successful, save actual local error if remote fallback fails */ + tmaj = maj; + tmin = min; + } + + /* Then try with remote */ + if (behavior == GPP_REMOTE_ONLY || behavior == GPP_REMOTE_FIRST) { + + maj = gpm_acquire_cred(&min, + NULL, 0, NULL, cred_usage, + &cred->remote, NULL, NULL); + + if (maj == GSS_S_COMPLETE || behavior == GPP_REMOTE_ONLY) { + goto done; + } + + /* So remote failed, but we can fallback to local, try that */ + maj = get_local_def_creds(&min, name, cred_usage, cred); + } + +done: + if (maj != GSS_S_COMPLETE && tmaj != GSS_S_COMPLETE) { + maj = tmaj; + min = tmin; + } + *minor_status = min; + if (maj != GSS_S_COMPLETE) { + gssi_release_cred(&min, (gss_cred_id_t *)&cred); + } + *cred_handle = cred; + return maj; +} + +OM_uint32 gssi_inquire_cred(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + gss_name_t *name, + OM_uint32 *lifetime, + gss_cred_usage_t *cred_usage, + gss_OID_set *mechanisms) +{ + struct gpp_cred_handle *cred = NULL; + struct gpp_name_handle *gpname = NULL; + OM_uint32 maj, min; + + if (cred_handle == GSS_C_NO_CREDENTIAL) { + maj = gppint_get_def_creds(&min, gpp_get_behavior(), NULL, + GSS_C_INITIATE, &cred); + if (maj != GSS_S_COMPLETE) { + goto done; + } + } else { + cred = (struct gpp_cred_handle *)cred_handle; + } + + if (name) { + gpname = calloc(1, sizeof(struct gpp_name_handle)); + if (!gpname) { + min = ENOMEM; + maj = GSS_S_FAILURE; + goto done; + } + } + + if (cred->local) { + maj = gss_inquire_cred(&min, cred->local, + gpname ? &gpname->local : NULL, + lifetime, cred_usage, mechanisms); + } else if (cred->remote) { + maj = gpm_inquire_cred(&min, cred->remote, + gpname ? &gpname->remote : NULL, + lifetime, cred_usage, mechanisms); + } else { + min = 0; + maj = GSS_S_FAILURE; + } + +done: + *minor_status = gpp_map_error(min); + if (cred_handle == GSS_C_NO_CREDENTIAL) { + gssi_release_cred(&min, (gss_cred_id_t*)&cred); + } + if (name && maj == GSS_S_COMPLETE) { + *name = (gss_name_t)gpname; + } else { + free(gpname); + } + return maj; +} + +OM_uint32 gssi_inquire_cred_by_mech(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + gss_OID mech_type, + gss_name_t *name, + OM_uint32 *initiator_lifetime, + OM_uint32 *acceptor_lifetime, + gss_cred_usage_t *cred_usage) +{ + struct gpp_cred_handle *cred = NULL; + struct gpp_name_handle *gpname = NULL; + OM_uint32 maj, min; + + if (cred_handle == GSS_C_NO_CREDENTIAL) { + maj = gppint_get_def_creds(&min, gpp_get_behavior(), NULL, + GSS_C_INITIATE, &cred); + if (maj != GSS_S_COMPLETE) { + goto done; + } + } else { + cred = (struct gpp_cred_handle *)cred_handle; + } + + if (name) { + gpname = calloc(1, sizeof(struct gpp_name_handle)); + if (!gpname) { + min = ENOMEM; + maj = GSS_S_FAILURE; + goto done; + } + } + + if (cred->local) { + maj = gss_inquire_cred_by_mech(&min, cred->local, + gpp_special_mech(mech_type), + gpname ? &gpname->local : NULL, + initiator_lifetime, acceptor_lifetime, + cred_usage); + } else if (cred->remote) { + maj = gpm_inquire_cred_by_mech(&min, cred->remote, mech_type, + gpname ? &gpname->remote : NULL, + initiator_lifetime, acceptor_lifetime, + cred_usage); + } else { + min = 0; + maj = GSS_S_FAILURE; + } + +done: + *minor_status = gpp_map_error(min); + if (cred_handle == GSS_C_NO_CREDENTIAL) { + gssi_release_cred(&min, (gss_cred_id_t*)&cred); + } + if (name && maj == GSS_S_COMPLETE) { + *name = (gss_name_t)gpname; + } else { + free(gpname); + } + return maj; +} + +OM_uint32 gssi_inquire_cred_by_oid(OM_uint32 *minor_status, + const gss_cred_id_t cred_handle, + const gss_OID desired_object, + gss_buffer_set_t *data_set) +{ + struct gpp_cred_handle *cred = NULL; + OM_uint32 maj, min; + + *minor_status = 0; + if (cred_handle == GSS_C_NO_CREDENTIAL) { + return GSS_S_CALL_INACCESSIBLE_READ; + } + cred = (struct gpp_cred_handle *)cred_handle; + + /* NOTE: For now we can do this only for local credentials, + * but as far as I know there is no real oid defined, at least + * for the krb5 mechs, so this may be a mooot point */ + if (!cred->local) { + return GSS_S_UNAVAILABLE; + } + + maj = gss_inquire_cred_by_oid(&min, cred->local, desired_object, data_set); + + *minor_status = gpp_map_error(min); + return maj; +} + +OM_uint32 gssi_set_cred_option(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + const gss_OID desired_object, + const gss_buffer_t value) +{ + struct gpp_cred_handle *cred = NULL; + OM_uint32 maj, min; + + *minor_status = 0; + if (cred_handle == GSS_C_NO_CREDENTIAL) { + return GSS_S_CALL_INACCESSIBLE_READ; + } + cred = (struct gpp_cred_handle *)cred_handle; + + /* NOTE: For now we can do this only for local credentials */ + if (!cred->local) { + return GSS_S_UNAVAILABLE; + } + + maj = gss_set_cred_option(&min, &cred->local, desired_object, value); + + *minor_status = gpp_map_error(min); + return maj; +} + +OM_uint32 gssi_store_cred(OM_uint32 *minor_status, + const gss_cred_id_t input_cred_handle, + gss_cred_usage_t input_usage, + const gss_OID desired_mech, + OM_uint32 overwrite_cred, + OM_uint32 default_cred, + gss_OID_set *elements_stored, + gss_cred_usage_t *cred_usage_stored) +{ + struct gpp_cred_handle *cred = NULL; + OM_uint32 maj, min; + + *minor_status = 0; + if (input_cred_handle == GSS_C_NO_CREDENTIAL) { + return GSS_S_CALL_INACCESSIBLE_READ; + } + cred = (struct gpp_cred_handle *)input_cred_handle; + + /* NOTE: For now we can do this only for local credentials */ + if (!cred->local) { + return GSS_S_UNAVAILABLE; + } + + maj = gss_store_cred(&min, cred->local, input_usage, + gpp_special_mech(desired_mech), + overwrite_cred, default_cred, + elements_stored, cred_usage_stored); + + *minor_status = gpp_map_error(min); + return maj; +} + +OM_uint32 gssi_release_cred(OM_uint32 *minor_status, + gss_cred_id_t *cred_handle) +{ + struct gpp_cred_handle *cred; + OM_uint32 maj, min; + OM_uint32 rmaj = GSS_S_COMPLETE; + + if (*cred_handle == GSS_C_NO_CREDENTIAL) { + *minor_status = 0; + return GSS_S_COMPLETE; + } + + cred = (struct gpp_cred_handle *)*cred_handle; + + if (cred->local) { + maj = gss_release_cred(&min, &cred->local); + if (maj != GSS_S_COMPLETE) { + rmaj = maj; + *minor_status = gpp_map_error(min); + } + } + + if (cred->remote) { + maj = gpm_release_cred(&min, &cred->remote); + if (maj && rmaj == GSS_S_COMPLETE) { + rmaj = maj; + *minor_status = gpp_map_error(min); + } + } + + *cred_handle = GSS_C_NO_CREDENTIAL; + return rmaj; +} + +OM_uint32 gssi_export_cred(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + gss_buffer_t token) +{ + struct gpp_cred_handle *cred; + + cred = (struct gpp_cred_handle *)cred_handle; + if (!cred) { + return GSS_S_CALL_INACCESSIBLE_READ; + } + + /* We do not support exporting creds via the proxy. + * It's exclusively a local operation for now */ + if (!cred->local) { + return GSS_S_CRED_UNAVAIL; + } + + return gss_export_cred(minor_status, cred->local, token); +} + +OM_uint32 gssi_import_cred(OM_uint32 *minor_status, + gss_buffer_t token, + gss_cred_id_t *cred_handle) +{ + return GSS_S_UNAVAILABLE; +} + +OM_uint32 gssi_import_cred_by_mech(OM_uint32 *minor_status, + gss_OID mech_type, + gss_buffer_t token, + gss_cred_id_t *cred_handle) +{ + struct gpp_cred_handle *cred; + gss_buffer_desc wrap_token = {0}; + gss_OID spmech; + OM_uint32 maj, min = 0; + uint32_t len; + + cred = calloc(1, sizeof(struct gpp_cred_handle)); + if (!cred) { + *minor_status = 0; + return GSS_S_FAILURE; + } + + /* NOTE: it makes no sense to import a cred remotely atm, + * so we only handle the local case for now. */ + spmech = gpp_special_mech(mech_type); + if (spmech == GSS_C_NO_OID) { + maj = GSS_S_FAILURE; + goto done; + } + + wrap_token.length = sizeof(uint32_t) + spmech->length + token->length; + wrap_token.value = malloc(wrap_token.length); + if (!wrap_token.value) { + wrap_token.length = 0; + maj = GSS_S_FAILURE; + goto done; + } + + len = htobe32(wrap_token.length); + memcpy(wrap_token.value, &len, sizeof(uint32_t)); + memcpy(wrap_token.value + sizeof(uint32_t), + spmech->elements, spmech->length); + memcpy(wrap_token.value + sizeof(uint32_t) + spmech->length, + token->value, token->length); + + maj = gss_import_cred(&min, &wrap_token, &cred->local); + +done: + *minor_status = gpp_map_error(min); + if (maj == GSS_S_COMPLETE) { + *cred_handle = (gss_cred_id_t)cred; + } else { + free(cred); + } + (void)gss_release_buffer(&min, &wrap_token); + return maj; +} + diff --git a/proxy/src/mechglue/gss_plugin.h b/proxy/src/mechglue/gss_plugin.h index 7fe5b5c..fb548e0 100644 --- a/proxy/src/mechglue/gss_plugin.h +++ b/proxy/src/mechglue/gss_plugin.h @@ -68,4 +68,78 @@ uint32_t gpp_name_to_local(uint32_t *minor, gssx_name *name, uint32_t gpp_local_to_name(uint32_t *minor, gss_name_t local_name, gssx_name **name); +OM_uint32 gssi_acquire_cred(OM_uint32 *minor_status, + const gss_name_t desired_name, + OM_uint32 time_req, + const gss_OID_set desired_mechs, + gss_cred_usage_t cred_usage, + gss_cred_id_t *output_cred_handle, + gss_OID_set *actual_mechs, + OM_uint32 *time_rec); + +OM_uint32 gssi_add_cred(OM_uint32 *minor_status, + const gss_cred_id_t input_cred_handle, + const gss_name_t desired_name, + const gss_OID desired_mech, + gss_cred_usage_t cred_usage, + OM_uint32 initiator_time_req, + OM_uint32 acceptor_time_req, + gss_cred_id_t *output_cred_handle, + gss_OID_set *actual_mechs, + OM_uint32 *initiator_time_rec, + OM_uint32 *acceptor_time_rec); + +OM_uint32 gssi_acquire_cred_with_password(OM_uint32 *minor_status, + const gss_name_t desired_name, + const gss_buffer_t password, + OM_uint32 time_req, + const gss_OID_set desired_mechs, + gss_cred_usage_t cred_usage, + gss_cred_id_t *output_cred_handle, + gss_OID_set *actual_mechs, + OM_uint32 *time_rec); + +OM_uint32 gppint_get_def_creds(OM_uint32 *minor_status, + enum gpp_behavior behavior, + struct gpp_name_handle *name, + gss_cred_usage_t cred_usage, + struct gpp_cred_handle **cred_handle); + +OM_uint32 gssi_inquire_cred(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + gss_name_t *name, + OM_uint32 *lifetime, + gss_cred_usage_t *cred_usage, + gss_OID_set *mechanisms); + +OM_uint32 gssi_inquire_cred_by_mech(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + gss_OID mech_type, + gss_name_t *name, + OM_uint32 *initiator_lifetime, + OM_uint32 *acceptor_lifetime, + gss_cred_usage_t *cred_usage); + +OM_uint32 gssi_inquire_cred_by_oid(OM_uint32 *minor_status, + const gss_cred_id_t cred_handle, + const gss_OID desired_object, + gss_buffer_set_t *data_set); + +OM_uint32 gssi_set_cred_option(OM_uint32 *minor_status, + gss_cred_id_t cred_handle, + const gss_OID desired_object, + const gss_buffer_t value); + +OM_uint32 gssi_store_cred(OM_uint32 *minor_status, + const gss_cred_id_t input_cred_handle, + gss_cred_usage_t input_usage, + const gss_OID desired_mech, + OM_uint32 overwrite_cred, + OM_uint32 default_cred, + gss_OID_set *elements_stored, + gss_cred_usage_t *cred_usage_stored); + +OM_uint32 gssi_release_cred(OM_uint32 *minor_status, + gss_cred_id_t *cred_handle); + #endif /* _GSS_PLUGIN_H_ */