diff options
| -rw-r--r-- | proxy/Makefile.am | 1 | ||||
| -rw-r--r-- | proxy/src/gp_config.c | 87 | ||||
| -rw-r--r-- | proxy/src/gp_export.c | 326 | ||||
| -rw-r--r-- | proxy/src/gp_export.h | 8 | ||||
| -rw-r--r-- | proxy/src/gp_proxy.h | 15 | ||||
| -rw-r--r-- | proxy/src/gp_ring_buffer.h | 37 | ||||
| -rw-r--r-- | proxy/src/gp_rpc_accept_sec_context.c | 6 | ||||
| -rw-r--r-- | proxy/src/gp_rpc_acquire_cred.c | 7 | ||||
| -rw-r--r-- | proxy/src/gp_rpc_init_sec_context.c | 7 | ||||
| -rw-r--r-- | proxy/src/gp_rpc_release_handle.c | 8 |
10 files changed, 98 insertions, 404 deletions
diff --git a/proxy/Makefile.am b/proxy/Makefile.am index 001e4e3..056e72b 100644 --- a/proxy/Makefile.am +++ b/proxy/Makefile.am @@ -124,7 +124,6 @@ dist_noinst_HEADERS = \ src/gp_creds.h \ src/gp_export.h \ src/gp_conv.h \ - src/gp_ring_buffer.h \ src/gp_debug.h \ src/gp_rpc_creds.h diff --git a/proxy/src/gp_config.c b/proxy/src/gp_config.c index 6776ed5..e6ad49c 100644 --- a/proxy/src/gp_config.c +++ b/proxy/src/gp_config.c @@ -30,10 +30,8 @@ #include <errno.h> #include "gp_proxy.h" #include "iniparser.h" -#include "gp_ring_buffer.h" #define GP_SOCKET_NAME "gssproxy.socket" -#define GP_RING_BUFFER_SIZE 4096 static void gp_service_free(struct gp_service *svc) { @@ -43,6 +41,7 @@ static void gp_service_free(struct gp_service *svc) free(svc->krb5.keytab); free(svc->krb5.ccache); } + gp_free_creds_handle(&svc->creds_handle); memset(svc, 0, sizeof(struct gp_service)); } @@ -126,39 +125,15 @@ static int get_krb5_mech_cfg(struct gp_service *svc, return 0; } -static int setup_service_ring_buffer(struct gp_config *cfg, - struct gp_service *svc, - int buffer_size) +static int setup_service_creds_handle(struct gp_service *svc) { uint32_t ret_maj, ret_min; - struct gp_ring_buffer **newrb; - uint32_t num; - if (buffer_size == -1) { - /* a reasonable default ? */ - buffer_size = GP_RING_BUFFER_SIZE; - } - - num = cfg->num_ring_buffers; - newrb = realloc(cfg->ring_buffers, - sizeof(struct gp_ring_buffer *) * (num + 1)); - if (!newrb) { - return ENOMEM; - } - cfg->ring_buffers = newrb; - - ret_maj = gp_init_ring_buffer(&ret_min, - svc->name, - buffer_size, - &cfg->ring_buffers[num]); + ret_maj = gp_init_creds_handle(&ret_min, &svc->creds_handle); if (ret_maj) { return ret_min; } - cfg->num_ring_buffers++; - - svc->ring_buffer = cfg->ring_buffers[num]; - return 0; } @@ -219,21 +194,9 @@ static int load_services(struct gp_config *cfg, dictionary *dict) } } - if (cfg->svcs[n]->trusted) { - /* buffer 0 is trusted */ - cfg->svcs[n]->ring_buffer = cfg->ring_buffers[0]; - } else { - /* buffer 1 is untrusted */ - cfg->svcs[n]->ring_buffer = cfg->ring_buffers[1]; - } - - value = get_char_value(dict, secname, "dedicated_ring_buffer"); - if (value && option_is_set(value)) { - valnum = get_int_value(dict, secname, "ring_buffer_size"); - ret = setup_service_ring_buffer(cfg, cfg->svcs[n], valnum); - if (ret) { - goto done; - } + ret = setup_service_creds_handle(cfg->svcs[n]); + if (ret) { + goto done; } value = get_char_value(dict, secname, "mechs"); @@ -322,34 +285,6 @@ int load_config(struct gp_config *cfg) cfg->num_workers = iniparser_getint(d, "gssproxy:worker threads", 0); - /* The two main ring_buffers need to be initialized before any dedicated - * ring_buffers (from services) are appended - gd */ - - cfg->num_ring_buffers = 2; - cfg->ring_buffers = calloc(cfg->num_ring_buffers, sizeof(struct gp_ring_buffer *)); - if (!cfg->ring_buffers) { - ret = ENOMEM; - goto done; - } - - ret_maj = gp_init_ring_buffer(&ret_min, - "default_trusted", - GP_RING_BUFFER_SIZE, - &cfg->ring_buffers[0]); - if (ret_maj) { - ret = ret_min; - goto done; - } - - ret_maj = gp_init_ring_buffer(&ret_min, - "default_untrusted", - GP_RING_BUFFER_SIZE, - &cfg->ring_buffers[1]); - if (ret_maj) { - ret = ret_min; - goto done; - } - ret = load_services(cfg, d); done: @@ -400,9 +335,9 @@ struct gp_config *read_config(char *config_file, int opt_daemonize) return cfg; } -struct gp_ring_buffer *gp_service_get_ring_buffer(struct gp_service *svc) +struct gp_creds_handle *gp_service_get_creds_handle(struct gp_service *svc) { - return svc->ring_buffer; + return svc->creds_handle; } void free_config(struct gp_config *config) @@ -421,10 +356,4 @@ void free_config(struct gp_config *config) } free(config->svcs); - - for (i=0; i < config->num_ring_buffers; i++) { - gp_free_ring_buffer(config->ring_buffers[i]); - } - - free(config->ring_buffers); } diff --git a/proxy/src/gp_export.c b/proxy/src/gp_export.c index 8a0efb7..ed0a8ab 100644 --- a/proxy/src/gp_export.c +++ b/proxy/src/gp_export.c @@ -37,122 +37,56 @@ #include <grp.h> #include <pthread.h> -#define GP_RING_BUFFER_KEY_ENCTYPE ENCTYPE_AES256_CTS_HMAC_SHA1_96 +#define GP_CREDS_HANDLE_KEY_ENCTYPE ENCTYPE_AES256_CTS_HMAC_SHA1_96 -struct gp_ring_buffer_cred { - uint64_t count; - gss_cred_id_t cred; -}; - -struct gp_ring_buffer { - char *name; - uint32_t end; - uint64_t count; - pthread_mutex_t lock; - struct gp_ring_buffer_cred **creds; - uint32_t num_creds; +struct gp_creds_handle { krb5_keyblock key; krb5_context context; }; -struct gp_credential_handle { - uint32_t index; - uint64_t count; -}; - -static void gp_free_ring_buffer_cred(struct gp_ring_buffer_cred *cred) +void gp_free_creds_handle(struct gp_creds_handle **in) { - uint32_t ret_min; + struct gp_creds_handle *handle = *in; - if (!cred) { + if (!handle) { return; } - gss_release_cred(&ret_min, &cred->cred); - - free(cred); -} - -void gp_free_ring_buffer(struct gp_ring_buffer *buffer) -{ - uint32_t i; - - if (!buffer) { - return; - } - - free(buffer->name); - - for (i=0; i < buffer->num_creds; i++) { - gp_free_ring_buffer_cred(buffer->creds[i]); - } - - free(buffer->creds); - - if (buffer->context) { - krb5_free_keyblock_contents(buffer->context, &buffer->key); - krb5_free_context(buffer->context); + if (handle->context) { + krb5_free_keyblock_contents(handle->context, &handle->key); + krb5_free_context(handle->context); } - pthread_mutex_destroy(&buffer->lock); - - free(buffer); + free(handle); + *in = NULL; + return; } -uint32_t gp_init_ring_buffer(uint32_t *min, - const char *name, - uint32_t ring_size, - struct gp_ring_buffer **buffer_out) +uint32_t gp_init_creds_handle(uint32_t *min, struct gp_creds_handle **out) { - struct gp_ring_buffer *buffer; + struct gp_creds_handle *handle; uint32_t ret_maj = 0; uint32_t ret_min = 0; int ret; - GPDEBUG("gp_init_ring_buffer %s (size: %d)\n", name, ring_size); - - buffer = calloc(1, sizeof(struct gp_ring_buffer)); - if (!buffer) { + handle = calloc(1, sizeof(struct gp_creds_handle)); + if (!handle) { ret_min = ENOMEM; ret_maj = GSS_S_FAILURE; goto done; } - buffer->name = strdup(name); - if (!buffer->name) { - ret_min = ENOMEM; - ret_maj = GSS_S_FAILURE; - goto done; - } - - buffer->num_creds = ring_size; - - buffer->creds = calloc(sizeof(struct gp_ring_buffer_cred *), buffer->num_creds); - if (!buffer->creds) { - ret_min = ENOMEM; - ret_maj = GSS_S_FAILURE; - goto done; - } - - ret = pthread_mutex_init(&buffer->lock, NULL); - if (ret) { - ret_min = ret; - ret_maj = GSS_S_FAILURE; - goto done; - } - /* initialize key */ - - ret = krb5_init_context(&buffer->context); + ret = krb5_init_context(&handle->context); if (ret) { ret_min = ret; ret_maj = GSS_S_FAILURE; goto done; } - ret = krb5_c_make_random_key(buffer->context, - GP_RING_BUFFER_KEY_ENCTYPE, - &buffer->key); + ret = krb5_c_make_random_key(handle->context, + GP_CREDS_HANDLE_KEY_ENCTYPE, + &handle->key); if (ret) { ret_min = ret; ret_maj = GSS_S_FAILURE; @@ -165,102 +99,13 @@ uint32_t gp_init_ring_buffer(uint32_t *min, done: *min = ret_min; if (ret_maj) { - gp_free_ring_buffer(buffer); + gp_free_creds_handle(&handle); } - *buffer_out = buffer; + *out = handle; return ret_maj; } -static uint32_t gp_write_gss_cred_to_ring_buffer(uint32_t *min, - struct gp_ring_buffer *buffer, - gss_cred_id_t *cred, - struct gp_credential_handle *handle) -{ - struct gp_ring_buffer_cred *bcred = NULL; - - if (!buffer || !cred) { - *min = EINVAL; - return GSS_S_FAILURE; - } - - bcred = calloc(1, sizeof(struct gp_ring_buffer_cred)); - if (!bcred) { - *min = ENOMEM; - return GSS_S_FAILURE; - } - - /* ======> LOCK */ - pthread_mutex_lock(&buffer->lock); - - /* setup ring buffer credential */ - bcred->count = buffer->count; - bcred->cred = *cred; - - /* setup credential handle */ - handle->count = buffer->count; - handle->index = buffer->end; - - /* store ring buffer credential */ - gp_free_ring_buffer_cred(buffer->creds[buffer->end]); - - buffer->creds[buffer->end] = bcred; - buffer->end = (buffer->end + 1) % buffer->num_creds; - - buffer->count++; - - /* <====== LOCK */ - pthread_mutex_unlock(&buffer->lock); - - *min = 0; - - return GSS_S_COMPLETE; -} - -static uint32_t gp_read_gss_creds_from_ring_buffer(uint32_t *min, - struct gp_ring_buffer *buffer, - struct gp_credential_handle *handle, - gss_cred_id_t *cred) -{ - struct gp_ring_buffer_cred *bcred; - - if (!buffer || !cred || !handle) { - *min = EINVAL; - return GSS_S_FAILURE; - } - - /* some basic sanity checks */ - if (handle->index > buffer->num_creds) { - *min = EINVAL; - return GSS_S_FAILURE; - } - - /* ======> LOCK */ - pthread_mutex_lock(&buffer->lock); - - /* pick ring buffer credential */ - bcred = buffer->creds[handle->index]; - if (bcred && - (bcred->count == handle->count)) { - *cred = bcred->cred; - } else { - *cred = NULL; - } - - /* <====== LOCK */ - pthread_mutex_unlock(&buffer->lock); - - if (*cred == NULL) { - *min = GSS_S_CRED_UNAVAIL; - return GSS_S_FAILURE; - } - - *min = 0; - - return GSS_S_COMPLETE; -} - - static int gp_encrypt_buffer(krb5_context context, krb5_keyblock *key, size_t len, void *buf, octet_string *out) { @@ -274,7 +119,7 @@ static int gp_encrypt_buffer(krb5_context context, krb5_keyblock *key, memset(&enc_handle, '\0', sizeof(krb5_enc_data)); ret = krb5_c_encrypt_length(context, - GP_RING_BUFFER_KEY_ENCTYPE, + GP_CREDS_HANDLE_KEY_ENCTYPE, data_in.length, (size_t *)&enc_handle.ciphertext.length); if (ret) { @@ -311,7 +156,7 @@ done: } static int gp_decrypt_buffer(krb5_context context, krb5_keyblock *key, - octet_string *in, size_t len, void *buf) + octet_string *in, size_t *len, void *buf) { int ret; krb5_data data_out; @@ -319,11 +164,11 @@ static int gp_decrypt_buffer(krb5_context context, krb5_keyblock *key, memset(&enc_handle, '\0', sizeof(krb5_enc_data)); - enc_handle.enctype = GP_RING_BUFFER_KEY_ENCTYPE; + enc_handle.enctype = GP_CREDS_HANDLE_KEY_ENCTYPE; enc_handle.ciphertext.data = in->octet_string_val; enc_handle.ciphertext.length = in->octet_string_len; - data_out.length = len; + data_out.length = *len; data_out.data = buf; ret = krb5_c_decrypt(context, @@ -336,11 +181,12 @@ static int gp_decrypt_buffer(krb5_context context, krb5_keyblock *key, return EINVAL; } + *len = data_out.length; + return 0; } -uint32_t gp_export_gssx_cred(uint32_t *min, - struct gp_service *svc, +uint32_t gp_export_gssx_cred(uint32_t *min, struct gp_service *svc, gss_cred_id_t *in, gssx_cred *out) { uint32_t ret_maj; @@ -354,8 +200,8 @@ uint32_t gp_export_gssx_cred(uint32_t *min, struct gssx_cred_element *el; int ret; int i, j; - struct gp_ring_buffer *ring_buffer = NULL; - struct gp_credential_handle handle; + struct gp_creds_handle *handle = NULL; + gss_buffer_desc token = GSS_C_EMPTY_BUFFER; ret_maj = gss_inquire_cred(&ret_min, *in, &name, &lifetime, &cred_usage, &mechanisms); @@ -421,37 +267,32 @@ uint32_t gp_export_gssx_cred(uint32_t *min, el->acceptor_time_rec = acceptor_lifetime; } - ring_buffer = gp_service_get_ring_buffer(svc); - if (!ring_buffer) { + handle = gp_service_get_creds_handle(svc); + if (!handle) { ret_maj = GSS_S_FAILURE; ret_min = EINVAL; goto done; } - ret = gp_write_gss_cred_to_ring_buffer(&ret_min, - ring_buffer, - in, - &handle); - if (ret) { - ret_maj = GSS_S_FAILURE; - ret_min = ret; + ret_maj = gss_export_cred(&ret_min, *in, &token); + if (ret_maj) { goto done; } - ret = gp_encrypt_buffer(ring_buffer->context, &ring_buffer->key, - sizeof(handle), &handle, + ret = gp_encrypt_buffer(handle->context, &handle->key, + token.length, token.value, &out->cred_handle_reference); if (ret) { ret_maj = GSS_S_FAILURE; ret_min = ret; goto done; } - out->needs_release = true; + out->needs_release = false; + /* now we have serialized creds in the hands of the client. + * we can safey free them here so that we can remain sateless and + * not leak memory */ + gss_release_cred(&ret_min, in); - /* we take over control of the credentials from here on */ - /* when we will have gss_export_cred() we will actually free - * them immediately instead */ - *in = NULL; ret_maj = GSS_S_COMPLETE; ret_min = 0; @@ -462,74 +303,45 @@ done: return ret_maj; } -static int gp_import_gssx_cred(struct gp_ring_buffer *ring_buffer, - struct gp_credential_handle *in, - gss_cred_id_t *out) -{ - uint32_t ret = 0; - uint32_t ret_min = 0; - - ret = gp_read_gss_creds_from_ring_buffer(&ret_min, - ring_buffer, - in, - out); - if (ret) { - return ret_min; - } - - return 0; -} - - - -int gp_find_cred_int(struct gp_ring_buffer *ring_buffer, gssx_cred *cred, - gss_cred_id_t *out, struct gp_credential_handle *handle) +uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_service *svc, + gssx_cred *cred, gss_cred_id_t *out) { + gss_buffer_desc token = GSS_C_EMPTY_BUFFER; + struct gp_creds_handle *handle = NULL; + uint32_t ret_maj; + uint32_t ret_min; int ret; - ret = gp_decrypt_buffer(ring_buffer->context, &ring_buffer->key, - &cred->cred_handle_reference, - sizeof(*handle), handle); - if (ret) { - return ENOENT; - } - - return gp_import_gssx_cred(ring_buffer, handle, out); -} - -int gp_find_cred(struct gp_service *svc, gssx_cred *cred, gss_cred_id_t *out) -{ - struct gp_ring_buffer *ring_buffer; - struct gp_credential_handle handle; - - ring_buffer = gp_service_get_ring_buffer(svc); - if (!ring_buffer) { - return EINVAL; + handle = gp_service_get_creds_handle(svc); + if (!handle) { + ret_maj = GSS_S_FAILURE; + ret_min = EINVAL; + goto done; } - return gp_find_cred_int(ring_buffer, cred, out, &handle); -} - -int gp_find_and_free_cred(struct gp_service *svc, gssx_cred *cred) -{ - struct gp_ring_buffer *ring_buffer; - struct gp_credential_handle handle; - gss_cred_id_t gss_cred; - int ret; - - ring_buffer = gp_service_get_ring_buffer(svc); - if (!ring_buffer) { - return EINVAL; + token.length = cred->cred_handle_reference.octet_string_len; + token.value = malloc(token.length); + if (!token.value) { + ret_maj = GSS_S_FAILURE; + ret_min = ENOMEM; + goto done; } - ret = gp_find_cred_int(ring_buffer, cred, &gss_cred, &handle); + ret = gp_decrypt_buffer(handle->context, &handle->key, + &cred->cred_handle_reference, + &token.length, token.value); if (ret) { - return ret; + ret_maj = GSS_S_FAILURE; + ret_min = ENOENT; + goto done; } - gp_free_ring_buffer_cred(ring_buffer->creds[handle.index]); + ret_maj = gss_import_cred(&ret_min, &token, out); - return 0; +done: + *min = ret_min; + free(token.value); + return ret_maj; } /* Exported Contexts */ diff --git a/proxy/src/gp_export.h b/proxy/src/gp_export.h index 5606c65..28d2229 100644 --- a/proxy/src/gp_export.h +++ b/proxy/src/gp_export.h @@ -31,12 +31,10 @@ struct gp_service; -uint32_t gp_export_gssx_cred(uint32_t *min, - struct gp_service *svc, +uint32_t gp_export_gssx_cred(uint32_t *min, struct gp_service *svc, gss_cred_id_t *in, gssx_cred *out); -int gp_find_cred(struct gp_service *svc, gssx_cred *cred, gss_cred_id_t *out); -int gp_find_and_free_cred(struct gp_service *svc, - gssx_cred *cred); +uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_service *svc, + gssx_cred *cred, gss_cred_id_t *out); int gp_get_exported_context_type(struct gssx_call_ctx *ctx); uint32_t gp_export_ctx_id_to_gssx(uint32_t *min, int type, diff --git a/proxy/src/gp_proxy.h b/proxy/src/gp_proxy.h index 3d52cfe..c599eee 100644 --- a/proxy/src/gp_proxy.h +++ b/proxy/src/gp_proxy.h @@ -42,7 +42,7 @@ struct gp_cred_krb5 { char *ccache; }; -struct gp_ring_buffer; +struct gp_creds_handle; struct gp_service { char *name; @@ -52,11 +52,9 @@ struct gp_service { uint32_t mechs; struct gp_cred_krb5 krb5; - struct gp_ring_buffer *ring_buffer; + struct gp_creds_handle *creds_handle; }; -struct gp_ring_buffer; - struct gp_config { char *config_file; /* gssproxy configuration file */ bool daemonize; /* let gssproxy daemonize */ @@ -65,9 +63,6 @@ struct gp_config { struct gp_service **svcs; int num_svcs; - - struct gp_ring_buffer **ring_buffers; - int num_ring_buffers; }; struct gp_workers; @@ -82,7 +77,7 @@ struct gp_conn; /* from gp_config.c */ struct gp_config *read_config(char *config_file, int opt_daemonize); -struct gp_ring_buffer *gp_service_get_ring_buffer(struct gp_service *svc); +struct gp_creds_handle *gp_service_get_creds_handle(struct gp_service *svc); void free_config(struct gp_config *config); /* from gp_init.c */ @@ -114,4 +109,8 @@ int gp_rpc_process_call(struct gssproxy_ctx *gpctx, struct gp_service *gp_creds_match_conn(struct gssproxy_ctx *gpctx, struct gp_conn *conn); +/* from gp_export.c */ +uint32_t gp_init_creds_handle(uint32_t *min, struct gp_creds_handle **out); +void gp_free_creds_handle(struct gp_creds_handle **in); + #endif /* _GP_PROXY_H_ */ diff --git a/proxy/src/gp_ring_buffer.h b/proxy/src/gp_ring_buffer.h deleted file mode 100644 index ea95f59..0000000 --- a/proxy/src/gp_ring_buffer.h +++ /dev/null @@ -1,37 +0,0 @@ -/* - GSS-PROXY - - Copyright (C) 2012 Red Hat, Inc. - Copyright (C) 2012 Guenther Deschner <guenther.deschner@redhat.com> - - Permission is hereby granted, free of charge, to any person obtaining a - copy of this software and associated documentation files (the "Software"), - to deal in the Software without restriction, including without limitation - the rights to use, copy, modify, merge, publish, distribute, sublicense, - and/or sell copies of the Software, and to permit persons to whom the - Software is furnished to do so, subject to the following conditions: - - The above copyright notice and this permission notice shall be included in - all copies or substantial portions of the Software. - - THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL - THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING - FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER - DEALINGS IN THE SOFTWARE. -*/ - -#ifndef _GP_RING_BUFFER_H_ -#define _GP_RING_BUFFER_H_ - -#include <gssapi/gssapi.h> - -uint32_t gp_init_ring_buffer(uint32_t *min, - const char *name, - uint32_t ring_size, - struct gp_ring_buffer **buffer_out); -void gp_free_ring_buffer(struct gp_ring_buffer *buffer); - -#endif /* _GP_RING_BUFFER_H_ */ diff --git a/proxy/src/gp_rpc_accept_sec_context.c b/proxy/src/gp_rpc_accept_sec_context.c index eb93471..e43b72a 100644 --- a/proxy/src/gp_rpc_accept_sec_context.c +++ b/proxy/src/gp_rpc_accept_sec_context.c @@ -67,10 +67,8 @@ int gp_accept_sec_context(struct gssproxy_ctx *gpctx, } if (asca->cred_handle) { - ret = gp_find_cred(gpsvc, asca->cred_handle, &ach); - if (ret) { - ret_maj = GSS_S_NO_CRED; - ret_min = ret; + ret_maj = gp_import_gssx_cred(&ret_min, gpsvc, asca->cred_handle, &ach); + if (ret_maj) { goto done; } } diff --git a/proxy/src/gp_rpc_acquire_cred.c b/proxy/src/gp_rpc_acquire_cred.c index 31e6346..5c34732 100644 --- a/proxy/src/gp_rpc_acquire_cred.c +++ b/proxy/src/gp_rpc_acquire_cred.c @@ -50,10 +50,9 @@ int gp_acquire_cred(struct gssproxy_ctx *gpctx, acr = &res->acquire_cred; if (aca->input_cred_handle) { - ret = gp_find_cred(gpsvc, aca->input_cred_handle, &in_cred); - if (ret) { - ret_maj = GSS_S_NO_CRED; - ret_min = ret; + ret_maj = gp_import_gssx_cred(&ret_min, gpsvc, + aca->input_cred_handle, &in_cred); + if (ret_maj) { goto done; } } diff --git a/proxy/src/gp_rpc_init_sec_context.c b/proxy/src/gp_rpc_init_sec_context.c index 480c4b7..fa87b15 100644 --- a/proxy/src/gp_rpc_init_sec_context.c +++ b/proxy/src/gp_rpc_init_sec_context.c @@ -68,10 +68,9 @@ int gp_init_sec_context(struct gssproxy_ctx *gpctx, } if (isca->cred_handle) { - ret = gp_find_cred(gpsvc, isca->cred_handle, &ich); - if (ret) { - ret_maj = GSS_S_NO_CRED; - ret_min = ret; + ret_maj = gp_import_gssx_cred(&ret_min, gpsvc, + isca->cred_handle, &ich); + if (ret_maj) { goto done; } } diff --git a/proxy/src/gp_rpc_release_handle.c b/proxy/src/gp_rpc_release_handle.c index 72aa7b8..a9f5ee2 100644 --- a/proxy/src/gp_rpc_release_handle.c +++ b/proxy/src/gp_rpc_release_handle.c @@ -47,11 +47,9 @@ int gp_release_handle(struct gssproxy_ctx *gpctx, ret_min = 0; break; case GSSX_C_HANDLE_CRED: - ret = gp_find_and_free_cred(gpsvc, &rha->cred_handle.gssx_handle_u.cred_info); - if (ret) { - ret_maj = GSS_S_UNAVAILABLE; - ret_min = 0; - } + /* We do not need release for any creds now */ + ret_maj = GSS_S_UNAVAILABLE; + ret_min = 0; break; default: ret_maj = GSS_S_CALL_BAD_STRUCTURE; |