src/gp_rpc_accept_sec_context.c - main - githubmirror/gssproxy

src/gp_rpc_accept_sec_context.c
194 строки6 KB
Robbie Harwood
Handle outdated encrypted ccaches
21 сен 2017, 22:30
21 сен 2017, 22:3079d56b6
/* Copyright (C) 2011 the GSS-PROXY contributors, see COPYING for license */

#include "gp_rpc_process.h"

int gp_accept_sec_context(struct gp_call_ctx *gpcall,
                          union gp_rpc_arg *arg,
                          union gp_rpc_res *res)
{
    struct gssx_arg_accept_sec_context *asca;
    struct gssx_res_accept_sec_context *ascr;
    uint32_t ret_maj;
    uint32_t ret_min;
    gss_ctx_id_t ctx = GSS_C_NO_CONTEXT;
    gss_cred_id_t ach = GSS_C_NO_CREDENTIAL;
    gss_buffer_desc ibuf;
    struct gss_channel_bindings_struct cbs;
    gss_channel_bindings_t pcbs;
    gss_name_t src_name = GSS_C_NO_NAME;
    gss_OID oid = GSS_C_NO_OID;
    gss_buffer_desc obuf = GSS_C_EMPTY_BUFFER;
    uint32_t ret_flags;
    gss_cred_id_t dch = GSS_C_NO_CREDENTIAL;
    gss_cred_id_t *pdch = NULL;
    int exp_ctx_type;
    int exp_creds_type;
    uint32_t acpt_maj;
    uint32_t acpt_min;
    struct gp_cred_check_handle gcch = {
        .ctx = gpcall,
        .options.options_len = arg->accept_sec_context.options.options_len,
        .options.options_val = arg->accept_sec_context.options.options_val,
    };
    uint32_t gccn_before = 0;
    uint32_t gccn_after = 0;
    int ret;

    asca = &arg->accept_sec_context;
    ascr = &res->accept_sec_context;

    GPRPCDEBUG(gssx_arg_accept_sec_context, asca);

    exp_ctx_type = gp_get_exported_context_type(&asca->call_ctx);
    if (exp_ctx_type == -1) {
        ret_maj = GSS_S_FAILURE;
        ret_min = EINVAL;
        goto done;
    }

    exp_creds_type = gp_get_export_creds_type(&asca->call_ctx);
    if (exp_creds_type == -1) {
        ret_maj = GSS_S_FAILURE;
        ret_min = EINVAL;
        goto done;
    }

    if (asca->cred_handle) {
        ret_maj = gp_import_gssx_cred(&ret_min, gpcall,
                                      asca->cred_handle, &ach);
        if (ret_maj) {
            goto done;
        }

        gccn_before = gp_check_sync_creds(&gcch, ach);
    }

    if (ach == GSS_C_NO_CREDENTIAL) {
        ret_maj = gp_add_krb5_creds(&ret_min, gpcall,
                                    ACQ_NORMAL, NULL, NULL,
                                    GSS_C_ACCEPT,
                                    0, 0,
                                    &ach,
                                    NULL, NULL, NULL);
        if (ret_maj) {
            goto done;
        }
    }

    gp_conv_gssx_to_buffer(&asca->input_token, &ibuf);

    if (asca->input_cb) {
        pcbs = &cbs;
        gp_conv_gssx_to_cb(asca->input_cb, pcbs);
    } else {
        pcbs = GSS_C_NO_CHANNEL_BINDINGS;
    }

    if (asca->ret_deleg_cred) {
        pdch = &dch;
    }

    ret_maj = gss_accept_sec_context(&ret_min,
                                     &ctx,
                                     ach,
                                     &ibuf,
                                     pcbs,
                                     &src_name,
                                     &oid,
                                     &obuf,
                                     &ret_flags,
                                     NULL,
                                     pdch);
    if (ret_maj != GSS_S_COMPLETE &&
        ret_maj != GSS_S_CONTINUE_NEEDED) {
        goto done;
    } else {
        acpt_maj = ret_maj;
        acpt_min = ret_min;
    }
    if (acpt_maj == GSS_S_CONTINUE_NEEDED) {
        exp_ctx_type = gp_get_continue_needed_type();
    }


    ascr->context_handle = calloc(1, sizeof(gssx_ctx));
    if (!ascr->context_handle) {
        ret_maj = GSS_S_FAILURE;
        ret_min = ENOMEM;
        goto done;
    }
    ret_maj = gp_export_ctx_id_to_gssx(&ret_min, exp_ctx_type, oid,
                                       &ctx, ascr->context_handle);
    if (ret_maj) {
        goto done;
    }

    ascr->output_token = calloc(1, sizeof(gssx_buffer));
    if (!ascr->output_token) {
        ret_maj = GSS_S_FAILURE;
        ret_min = ENOMEM;
        goto done;
    }
    ret = gp_conv_buffer_to_gssx(&obuf, ascr->output_token);
    if (ret) {
        ret_maj = GSS_S_FAILURE;
        ret_min = ret;
        goto done;
    }

    if ((ret_flags & GSS_C_DELEG_FLAG) && asca->ret_deleg_cred && dch) {
        ascr->delegated_cred_handle = calloc(1, sizeof(gssx_cred));
        if (!ascr->delegated_cred_handle) {
            ret_maj = GSS_S_FAILURE;
            ret_min = ENOMEM;
            goto done;
        }
        ret_maj = gp_export_gssx_cred(&ret_min, gpcall,
                                      &dch, ascr->delegated_cred_handle);
        if (ret_maj) {
            goto done;
        }
    }

    ret_maj = gp_export_creds_to_gssx_options(&ret_min,
                                              exp_creds_type,
                                              src_name, oid,
                                              &ascr->options.options_len,
                                              &ascr->options.options_val);
    if (ret_maj) {
        goto done;
    }

    gccn_after = gp_check_sync_creds(&gcch, ach);

    if (gccn_before != gccn_after) {
        /* export creds back to client for sync up */
        ret_maj = gp_export_sync_creds(&ret_min, gpcall, &ach,
                                       &ascr->options.options_val,
                                       &ascr->options.options_len);
        if (ret_maj) {
            /* not fatal, log and continue */
            GPDEBUG("Failed to export sync creds (%d: %d)",
                    (int)ret_maj, (int)ret_min);
        }
    }

    ret_maj = GSS_S_COMPLETE;

done:
    if (ret_maj == GSS_S_COMPLETE) {
        ret_maj = acpt_maj;
        ret_min = acpt_min;
    }
    ret = gp_conv_status_to_gssx(ret_maj, ret_min, oid,
                                 &ascr->status);
    GPRPCDEBUG(gssx_res_accept_sec_context, ascr);

    gss_release_name(&ret_min, &src_name);
    gss_release_buffer(&ret_min, &obuf);
    gss_release_cred(&ret_min, &dch);
    gss_release_cred(&ret_min, &ach);
    gss_delete_sec_context(&ret_min, &ctx, GSS_C_NO_BUFFER);

    return ret;
}