| 1 | /*
|
|---|
| 2 | * Copyright (c) 1997 - 2005 Kungliga Tekniska Högskolan
|
|---|
| 3 | * (Royal Institute of Technology, Stockholm, Sweden).
|
|---|
| 4 | * All rights reserved.
|
|---|
| 5 | *
|
|---|
| 6 | * Redistribution and use in source and binary forms, with or without
|
|---|
| 7 | * modification, are permitted provided that the following conditions
|
|---|
| 8 | * are met:
|
|---|
| 9 | *
|
|---|
| 10 | * 1. Redistributions of source code must retain the above copyright
|
|---|
| 11 | * notice, this list of conditions and the following disclaimer.
|
|---|
| 12 | *
|
|---|
| 13 | * 2. Redistributions in binary form must reproduce the above copyright
|
|---|
| 14 | * notice, this list of conditions and the following disclaimer in the
|
|---|
| 15 | * documentation and/or other materials provided with the distribution.
|
|---|
| 16 | *
|
|---|
| 17 | * 3. Neither the name of the Institute nor the names of its contributors
|
|---|
| 18 | * may be used to endorse or promote products derived from this software
|
|---|
| 19 | * without specific prior written permission.
|
|---|
| 20 | *
|
|---|
| 21 | * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
|---|
| 22 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|---|
| 23 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|---|
| 24 | * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
|---|
| 25 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|---|
| 26 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|---|
| 27 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|---|
| 28 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|---|
| 29 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|---|
| 30 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|---|
| 31 | * SUCH DAMAGE.
|
|---|
| 32 | */
|
|---|
| 33 |
|
|---|
| 34 | #include "krb5_locl.h"
|
|---|
| 35 |
|
|---|
| 36 | /**
|
|---|
| 37 | * Free content of krb5_creds.
|
|---|
| 38 | *
|
|---|
| 39 | * @param context Kerberos 5 context.
|
|---|
| 40 | * @param c krb5_creds to free.
|
|---|
| 41 | *
|
|---|
| 42 | * @return Returns 0 to indicate success. Otherwise an kerberos et
|
|---|
| 43 | * error code is returned, see krb5_get_error_message().
|
|---|
| 44 | *
|
|---|
| 45 | * @ingroup krb5
|
|---|
| 46 | */
|
|---|
| 47 |
|
|---|
| 48 | krb5_error_code KRB5_LIB_FUNCTION
|
|---|
| 49 | krb5_free_cred_contents (krb5_context context, krb5_creds *c)
|
|---|
| 50 | {
|
|---|
| 51 | krb5_free_principal (context, c->client);
|
|---|
| 52 | c->client = NULL;
|
|---|
| 53 | krb5_free_principal (context, c->server);
|
|---|
| 54 | c->server = NULL;
|
|---|
| 55 | krb5_free_keyblock_contents (context, &c->session);
|
|---|
| 56 | krb5_data_free (&c->ticket);
|
|---|
| 57 | krb5_data_free (&c->second_ticket);
|
|---|
| 58 | free_AuthorizationData (&c->authdata);
|
|---|
| 59 | krb5_free_addresses (context, &c->addresses);
|
|---|
| 60 | memset(c, 0, sizeof(*c));
|
|---|
| 61 | return 0;
|
|---|
| 62 | }
|
|---|
| 63 |
|
|---|
| 64 | /**
|
|---|
| 65 | * Copy content of krb5_creds.
|
|---|
| 66 | *
|
|---|
| 67 | * @param context Kerberos 5 context.
|
|---|
| 68 | * @param incred source credential
|
|---|
| 69 | * @param c destination credential, free with krb5_free_cred_contents().
|
|---|
| 70 | *
|
|---|
| 71 | * @return Returns 0 to indicate success. Otherwise an kerberos et
|
|---|
| 72 | * error code is returned, see krb5_get_error_message().
|
|---|
| 73 | *
|
|---|
| 74 | * @ingroup krb5
|
|---|
| 75 | */
|
|---|
| 76 |
|
|---|
| 77 | krb5_error_code KRB5_LIB_FUNCTION
|
|---|
| 78 | krb5_copy_creds_contents (krb5_context context,
|
|---|
| 79 | const krb5_creds *incred,
|
|---|
| 80 | krb5_creds *c)
|
|---|
| 81 | {
|
|---|
| 82 | krb5_error_code ret;
|
|---|
| 83 |
|
|---|
| 84 | memset(c, 0, sizeof(*c));
|
|---|
| 85 | ret = krb5_copy_principal (context, incred->client, &c->client);
|
|---|
| 86 | if (ret)
|
|---|
| 87 | goto fail;
|
|---|
| 88 | ret = krb5_copy_principal (context, incred->server, &c->server);
|
|---|
| 89 | if (ret)
|
|---|
| 90 | goto fail;
|
|---|
| 91 | ret = krb5_copy_keyblock_contents (context, &incred->session, &c->session);
|
|---|
| 92 | if (ret)
|
|---|
| 93 | goto fail;
|
|---|
| 94 | c->times = incred->times;
|
|---|
| 95 | ret = krb5_data_copy (&c->ticket,
|
|---|
| 96 | incred->ticket.data,
|
|---|
| 97 | incred->ticket.length);
|
|---|
| 98 | if (ret)
|
|---|
| 99 | goto fail;
|
|---|
| 100 | ret = krb5_data_copy (&c->second_ticket,
|
|---|
| 101 | incred->second_ticket.data,
|
|---|
| 102 | incred->second_ticket.length);
|
|---|
| 103 | if (ret)
|
|---|
| 104 | goto fail;
|
|---|
| 105 | ret = copy_AuthorizationData(&incred->authdata, &c->authdata);
|
|---|
| 106 | if (ret)
|
|---|
| 107 | goto fail;
|
|---|
| 108 | ret = krb5_copy_addresses (context,
|
|---|
| 109 | &incred->addresses,
|
|---|
| 110 | &c->addresses);
|
|---|
| 111 | if (ret)
|
|---|
| 112 | goto fail;
|
|---|
| 113 | c->flags = incred->flags;
|
|---|
| 114 | return 0;
|
|---|
| 115 |
|
|---|
| 116 | fail:
|
|---|
| 117 | krb5_free_cred_contents (context, c);
|
|---|
| 118 | return ret;
|
|---|
| 119 | }
|
|---|
| 120 |
|
|---|
| 121 | /**
|
|---|
| 122 | * Copy krb5_creds.
|
|---|
| 123 | *
|
|---|
| 124 | * @param context Kerberos 5 context.
|
|---|
| 125 | * @param incred source credential
|
|---|
| 126 | * @param outcred destination credential, free with krb5_free_creds().
|
|---|
| 127 | *
|
|---|
| 128 | * @return Returns 0 to indicate success. Otherwise an kerberos et
|
|---|
| 129 | * error code is returned, see krb5_get_error_message().
|
|---|
| 130 | *
|
|---|
| 131 | * @ingroup krb5
|
|---|
| 132 | */
|
|---|
| 133 |
|
|---|
| 134 | krb5_error_code KRB5_LIB_FUNCTION
|
|---|
| 135 | krb5_copy_creds (krb5_context context,
|
|---|
| 136 | const krb5_creds *incred,
|
|---|
| 137 | krb5_creds **outcred)
|
|---|
| 138 | {
|
|---|
| 139 | krb5_creds *c;
|
|---|
| 140 |
|
|---|
| 141 | c = malloc (sizeof (*c));
|
|---|
| 142 | if (c == NULL) {
|
|---|
| 143 | krb5_set_error_message (context, ENOMEM,
|
|---|
| 144 | N_("malloc: out of memory", ""));
|
|---|
| 145 | return ENOMEM;
|
|---|
| 146 | }
|
|---|
| 147 | memset (c, 0, sizeof(*c));
|
|---|
| 148 | *outcred = c;
|
|---|
| 149 | return krb5_copy_creds_contents (context, incred, c);
|
|---|
| 150 | }
|
|---|
| 151 |
|
|---|
| 152 | /**
|
|---|
| 153 | * Free krb5_creds.
|
|---|
| 154 | *
|
|---|
| 155 | * @param context Kerberos 5 context.
|
|---|
| 156 | * @param c krb5_creds to free.
|
|---|
| 157 | *
|
|---|
| 158 | * @return Returns 0 to indicate success. Otherwise an kerberos et
|
|---|
| 159 | * error code is returned, see krb5_get_error_message().
|
|---|
| 160 | *
|
|---|
| 161 | * @ingroup krb5
|
|---|
| 162 | */
|
|---|
| 163 |
|
|---|
| 164 | krb5_error_code KRB5_LIB_FUNCTION
|
|---|
| 165 | krb5_free_creds (krb5_context context, krb5_creds *c)
|
|---|
| 166 | {
|
|---|
| 167 | krb5_free_cred_contents (context, c);
|
|---|
| 168 | free (c);
|
|---|
| 169 | return 0;
|
|---|
| 170 | }
|
|---|
| 171 |
|
|---|
| 172 | /* XXX this do not belong here */
|
|---|
| 173 | static krb5_boolean
|
|---|
| 174 | krb5_times_equal(const krb5_times *a, const krb5_times *b)
|
|---|
| 175 | {
|
|---|
| 176 | return a->starttime == b->starttime &&
|
|---|
| 177 | a->authtime == b->authtime &&
|
|---|
| 178 | a->endtime == b->endtime &&
|
|---|
| 179 | a->renew_till == b->renew_till;
|
|---|
| 180 | }
|
|---|
| 181 |
|
|---|
| 182 | /**
|
|---|
| 183 | * Return TRUE if `mcreds' and `creds' are equal (`whichfields'
|
|---|
| 184 | * determines what equal means).
|
|---|
| 185 | *
|
|---|
| 186 | * @param context Kerberos 5 context.
|
|---|
| 187 | * @param whichfields which fields to compare.
|
|---|
| 188 | * @param mcreds cred to compare with.
|
|---|
| 189 | * @param creds cred to compare with.
|
|---|
| 190 | *
|
|---|
| 191 | * @return return TRUE if mcred and creds are equal, FALSE if not.
|
|---|
| 192 | *
|
|---|
| 193 | * @ingroup krb5
|
|---|
| 194 | */
|
|---|
| 195 |
|
|---|
| 196 | krb5_boolean KRB5_LIB_FUNCTION
|
|---|
| 197 | krb5_compare_creds(krb5_context context, krb5_flags whichfields,
|
|---|
| 198 | const krb5_creds * mcreds, const krb5_creds * creds)
|
|---|
| 199 | {
|
|---|
| 200 | krb5_boolean match = TRUE;
|
|---|
| 201 |
|
|---|
| 202 | if (match && mcreds->server) {
|
|---|
| 203 | if (whichfields & (KRB5_TC_DONT_MATCH_REALM | KRB5_TC_MATCH_SRV_NAMEONLY))
|
|---|
| 204 | match = krb5_principal_compare_any_realm (context, mcreds->server,
|
|---|
| 205 | creds->server);
|
|---|
| 206 | else
|
|---|
| 207 | match = krb5_principal_compare (context, mcreds->server,
|
|---|
| 208 | creds->server);
|
|---|
| 209 | }
|
|---|
| 210 |
|
|---|
| 211 | if (match && mcreds->client) {
|
|---|
| 212 | if(whichfields & KRB5_TC_DONT_MATCH_REALM)
|
|---|
| 213 | match = krb5_principal_compare_any_realm (context, mcreds->client,
|
|---|
| 214 | creds->client);
|
|---|
| 215 | else
|
|---|
| 216 | match = krb5_principal_compare (context, mcreds->client,
|
|---|
| 217 | creds->client);
|
|---|
| 218 | }
|
|---|
| 219 |
|
|---|
| 220 | if (match && (whichfields & KRB5_TC_MATCH_KEYTYPE))
|
|---|
| 221 | match = mcreds->session.keytype == creds->session.keytype;
|
|---|
| 222 |
|
|---|
| 223 | if (match && (whichfields & KRB5_TC_MATCH_FLAGS_EXACT))
|
|---|
| 224 | match = mcreds->flags.i == creds->flags.i;
|
|---|
| 225 |
|
|---|
| 226 | if (match && (whichfields & KRB5_TC_MATCH_FLAGS))
|
|---|
| 227 | match = (creds->flags.i & mcreds->flags.i) == mcreds->flags.i;
|
|---|
| 228 |
|
|---|
| 229 | if (match && (whichfields & KRB5_TC_MATCH_TIMES_EXACT))
|
|---|
| 230 | match = krb5_times_equal(&mcreds->times, &creds->times);
|
|---|
| 231 |
|
|---|
| 232 | if (match && (whichfields & KRB5_TC_MATCH_TIMES))
|
|---|
| 233 | /* compare only expiration times */
|
|---|
| 234 | match = (mcreds->times.renew_till <= creds->times.renew_till) &&
|
|---|
| 235 | (mcreds->times.endtime <= creds->times.endtime);
|
|---|
| 236 |
|
|---|
| 237 | if (match && (whichfields & KRB5_TC_MATCH_AUTHDATA)) {
|
|---|
| 238 | unsigned int i;
|
|---|
| 239 | if(mcreds->authdata.len != creds->authdata.len)
|
|---|
| 240 | match = FALSE;
|
|---|
| 241 | else
|
|---|
| 242 | for(i = 0; match && i < mcreds->authdata.len; i++)
|
|---|
| 243 | match = (mcreds->authdata.val[i].ad_type ==
|
|---|
| 244 | creds->authdata.val[i].ad_type) &&
|
|---|
| 245 | (krb5_data_cmp(&mcreds->authdata.val[i].ad_data,
|
|---|
| 246 | &creds->authdata.val[i].ad_data) == 0);
|
|---|
| 247 | }
|
|---|
| 248 | if (match && (whichfields & KRB5_TC_MATCH_2ND_TKT))
|
|---|
| 249 | match = (krb5_data_cmp(&mcreds->second_ticket, &creds->second_ticket) == 0);
|
|---|
| 250 |
|
|---|
| 251 | if (match && (whichfields & KRB5_TC_MATCH_IS_SKEY))
|
|---|
| 252 | match = ((mcreds->second_ticket.length == 0) ==
|
|---|
| 253 | (creds->second_ticket.length == 0));
|
|---|
| 254 |
|
|---|
| 255 | return match;
|
|---|
| 256 | }
|
|---|
| 257 |
|
|---|
| 258 | /**
|
|---|
| 259 | * Returns the ticket flags for the credentials in creds.
|
|---|
| 260 | * See also krb5_ticket_get_flags().
|
|---|
| 261 | *
|
|---|
| 262 | * @param creds credential to get ticket flags from
|
|---|
| 263 | *
|
|---|
| 264 | * @return ticket flags
|
|---|
| 265 | *
|
|---|
| 266 | * @ingroup krb5
|
|---|
| 267 | */
|
|---|
| 268 |
|
|---|
| 269 | unsigned long
|
|---|
| 270 | krb5_creds_get_ticket_flags(krb5_creds *creds)
|
|---|
| 271 | {
|
|---|
| 272 | return TicketFlags2int(creds->flags.b);
|
|---|
| 273 | }
|
|---|
