summaryrefslogtreecommitdiffstats
path: root/src/lib/rpc/svc_auth_gssapi.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/rpc/svc_auth_gssapi.c')
-rw-r--r--src/lib/rpc/svc_auth_gssapi.c120
1 files changed, 60 insertions, 60 deletions
diff --git a/src/lib/rpc/svc_auth_gssapi.c b/src/lib/rpc/svc_auth_gssapi.c
index e14a581a6a..9688b8cd7c 100644
--- a/src/lib/rpc/svc_auth_gssapi.c
+++ b/src/lib/rpc/svc_auth_gssapi.c
@@ -162,20 +162,20 @@ enum auth_stat gssrpc__svcauth_gssapi(
uint32_t seq_num;
PRINTF(("svcauth_gssapi: starting\n"));
-
+
/* clean up expired entries */
clean_client();
/* use AUTH_NONE until there is a client_handle */
rqst->rq_xprt->xp_auth = &svc_auth_none;
-
+
memset(&call_res, 0, sizeof(call_res));
creds.client_handle.length = 0;
creds.client_handle.value = NULL;
-
+
cred = &msg->rm_call.cb_cred;
verf = &msg->rm_call.cb_verf;
-
+
if (cred->oa_length == 0) {
PRINTF(("svcauth_gssapi: empty creds, failing\n"));
LOG_MISCERR("empty client credentials");
@@ -184,7 +184,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
}
PRINTF(("svcauth_gssapi: decoding credentials\n"));
- xdrmem_create(&xdrs, cred->oa_base, cred->oa_length, XDR_DECODE);
+ xdrmem_create(&xdrs, cred->oa_base, cred->oa_length, XDR_DECODE);
memset(&creds, 0, sizeof(creds));
if (! xdr_authgssapi_creds(&xdrs, &creds)) {
PRINTF(("svcauth_gssapi: failed decoding creds\n"));
@@ -217,7 +217,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
}
}
#endif
-
+
/*
* If this is an auth_msg and proc is GSSAPI_INIT, then create a
* client handle for this client. Otherwise, look up the
@@ -230,9 +230,9 @@ enum auth_stat gssrpc__svcauth_gssapi(
ret = AUTH_FAILED;
goto error;
}
-
+
PRINTF(("svcauth_gssapi: GSSAPI_INIT, creating client.\n"));
-
+
client_data = create_client();
if (client_data == NULL) {
PRINTF(("svcauth_gssapi: create_client failed\n"));
@@ -247,8 +247,8 @@ enum auth_stat gssrpc__svcauth_gssapi(
ret = AUTH_FAILED;
goto error;
}
-
- PRINTF(("svcauth_gssapi: incoming client_handle %d, len %d\n",
+
+ PRINTF(("svcauth_gssapi: incoming client_handle %d, len %d\n",
*((uint32_t *) creds.client_handle.value),
(int) creds.client_handle.length));
@@ -265,7 +265,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
/* any response we send will use client_handle, so set it now */
call_res.client_handle.length = sizeof(client_data->key);
call_res.client_handle.value = (char *) &client_data->key;
-
+
/* mark this call as using AUTH_GSSAPI via client_data's SVCAUTH */
rqst->rq_xprt->xp_auth = &client_data->svcauth;
@@ -304,7 +304,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
/*
* Process the call arg version number.
- *
+ *
* Set the krb5_gss backwards-compatibility mode based on client
* version. This controls whether the AP_REP message is
* encrypted with the session key (version 2+, correct) or the
@@ -369,7 +369,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
* If accept_sec_context returns something other than
* success and GSS_S_FAILURE, then assume different
* credentials won't help and stop looping.
- *
+ *
* Note that there are really two cases here: (1) the client
* has a server_creds already, and (2) it does not. They
* are both written in the same loop so that there is only
@@ -384,7 +384,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
PRINTF(("svcauth_gssapi: trying creds %d\n", i));
server_creds = server_creds_list[i];
}
-
+
/* Free previous output_token from loop */
if(i != 0) gss_release_buffer(&minor_stat, &output_token);
@@ -428,7 +428,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
break;
}
}
-
+
gssstat = call_res.gss_major;
minor_stat = call_res.gss_minor;
@@ -448,7 +448,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
call_res.gss_minor,
&rqst->rq_xprt->xp_raddr,
log_badauth_data);
-
+
gss_release_buffer(&minor_stat, &output_token);
svc_sendreply(rqst->rq_xprt, xdr_authgssapi_init_res,
(caddr_t) &call_res);
@@ -456,7 +456,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
ret = AUTH_OK;
goto error;
}
-
+
if (output_token.length != 0) {
PRINTF(("svcauth_gssapi: got new output token\n"));
GSS_COPY_BUFFER(call_res.token, output_token);
@@ -468,7 +468,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
(time_rec == GSS_C_INDEFINITE ?
INDEF_EXPIRE : time_rec) + time(0));
- PRINTF(("svcauth_gssapi: context established, isn %d\n",
+ PRINTF(("svcauth_gssapi: context established, isn %d\n",
client_data->seq_num));
if (auth_gssapi_seal_seq(client_data->context,
@@ -503,17 +503,17 @@ enum auth_stat gssrpc__svcauth_gssapi(
/* check the verifier */
PRINTF(("svcauth_gssapi: checking verifier, len %d\n",
verf->oa_length));
-
+
in_buf.length = verf->oa_length;
in_buf.value = verf->oa_base;
-
+
if (auth_gssapi_unseal_seq(client_data->context, &in_buf,
&seq_num) == FALSE) {
ret = AUTH_BADVERF;
LOG_MISCERR("internal error unsealing sequence number");
goto error;
}
-
+
if (seq_num != client_data->seq_num + 1) {
PRINTF(("svcauth_gssapi: expected isn %d, got %d\n",
client_data->seq_num + 1, seq_num));
@@ -521,12 +521,12 @@ enum auth_stat gssrpc__svcauth_gssapi(
(*log_badverf)(client_data->client_name,
client_data->server_name,
rqst, msg, log_badverf_data);
-
+
ret = AUTH_REJECTEDVERF;
goto error;
}
client_data->seq_num++;
-
+
PRINTF(("svcauth_gssapi: seq_num %d okay\n", seq_num));
/* free previous response verifier, if any */
@@ -534,7 +534,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
gss_release_buffer(&minor_stat, &client_data->prev_verf);
client_data->prev_verf.length = 0;
}
-
+
/* prepare response verifier */
seq_num = client_data->seq_num + 1;
if (auth_gssapi_seal_seq(client_data->context, seq_num,
@@ -543,17 +543,17 @@ enum auth_stat gssrpc__svcauth_gssapi(
LOG_MISCERR("internal error sealing sequence number");
goto error;
}
-
+
client_data->seq_num++;
-
+
PRINTF(("svcauth_gssapi; response seq_num %d\n", seq_num));
-
+
rqst->rq_xprt->xp_verf.oa_flavor = AUTH_GSSAPI;
- rqst->rq_xprt->xp_verf.oa_base = out_buf.value;
+ rqst->rq_xprt->xp_verf.oa_base = out_buf.value;
rqst->rq_xprt->xp_verf.oa_length = out_buf.length;
/* save verifier so it can be freed next time */
- client_data->prev_verf.value = out_buf.value;
+ client_data->prev_verf.value = out_buf.value;
client_data->prev_verf.length = out_buf.length;
/*
@@ -590,7 +590,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
/* done with call args */
xdr_free(xdr_authgssapi_init_arg, &call_arg);
-
+
if (gssstat != GSS_S_COMPLETE) {
AUTH_GSSAPI_DISPLAY_STATUS(("processing token",
gssstat, minor_stat));
@@ -604,7 +604,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
case AUTH_GSSAPI_DESTROY:
PRINTF(("svcauth_gssapi: GSSAPI_DESTROY\n"));
-
+
PRINTF(("svcauth_gssapi: sending reply\n"));
svc_sendreply(rqst->rq_xprt, xdr_void, NULL);
*no_dispatch = TRUE;
@@ -634,7 +634,7 @@ enum auth_stat gssrpc__svcauth_gssapi(
(int) creds.client_handle.length));
xdr_free(xdr_authgssapi_creds, &creds);
}
-
+
PRINTF(("\n"));
return AUTH_OK;
@@ -644,7 +644,7 @@ error:
(int) creds.client_handle.length));
xdr_free(xdr_authgssapi_creds, &creds);
}
-
+
PRINTF(("\n"));
return ret;
}
@@ -664,7 +664,7 @@ static void cleanup(void)
}
exit(0);
-}
+}
/*
* Function: create_client
@@ -675,7 +675,7 @@ static void cleanup(void)
* Returns: the new client_data structure, or NULL on failure.
*
* Effects:
- *
+ *
* A new client_data is created and stored in the hash table and
* b-tree. A new key that is unique in the current database is
* chosen; this key should be used as the client's client_handle.
@@ -685,41 +685,41 @@ static svc_auth_gssapi_data *create_client(void)
client_list *c;
svc_auth_gssapi_data *client_data;
static int client_key = 1;
-
+
PRINTF(("svcauth_gssapi: empty creds, creating\n"));
client_data = (svc_auth_gssapi_data *) malloc(sizeof(*client_data));
if (client_data == NULL)
return NULL;
memset(client_data, 0, sizeof(*client_data));
- L_PRINTF(2, ("create_client: new client_data = %p\n",
+ L_PRINTF(2, ("create_client: new client_data = %p\n",
(void *) client_data));
-
+
/* set up client data structure */
client_data->established = 0;
client_data->context = GSS_C_NO_CONTEXT;
client_data->expiration = time(0) + INITIATION_TIMEOUT;
-
+
/* set up psycho-recursive SVCAUTH hack */
client_data->svcauth.svc_ah_ops = &svc_auth_gssapi_ops;
client_data->svcauth.svc_ah_private = (caddr_t) client_data;
client_data->key = client_key++;
-
+
c = (client_list *) malloc(sizeof(client_list));
if (c == NULL)
return NULL;
c->client = client_data;
c->next = NULL;
-
-
+
+
if (clients == NULL)
clients = c;
else {
c->next = clients;
clients = c;
}
-
+
PRINTF(("svcauth_gssapi: new handle %d\n", client_data->key));
L_PRINTF(2, ("create_client: done\n"));
@@ -773,18 +773,18 @@ static svc_auth_gssapi_data *get_client(gss_buffer_t client_handle)
{
client_list *c;
uint32_t handle;
-
+
memcpy(&handle, client_handle->value, 4);
-
+
L_PRINTF(2, ("get_client: looking for client %d\n", handle));
-
+
c = clients;
while (c) {
if (c->client->key == handle)
return c->client;
c = c->next;
}
-
+
L_PRINTF(2, ("get_client: client_handle lookup failed\n"));
return NULL;
}
@@ -825,7 +825,7 @@ static void destroy_client(svc_auth_gssapi_data *client_data)
if (gssstat != GSS_S_COMPLETE)
AUTH_GSSAPI_DISPLAY_STATUS(("deleting context", gssstat,
minor_stat));
-
+
gss_release_buffer(&minor_stat, &out_buf);
gss_release_name(&minor_stat, &client_data->client_name);
if (client_data->prev_verf.length != 0)
@@ -854,13 +854,13 @@ static void destroy_client(svc_auth_gssapi_data *client_data)
PRINTF(("destroy_client: client_handle delete failed\n"));
abort();
}
-
+
done:
-
+
L_PRINTF(2, ("destroy_client: client %d destroyed\n", client_data->key));
-
+
free(client_data);
-
+
#if 0 /*ifdef PURIFY*/
purify_watch_n(client_data, sizeof(*client_data), "rw");
#endif
@@ -894,10 +894,10 @@ static void clean_client(void)
c = clients;
while (c) {
client_data = c->client;
-
+
L_PRINTF(2, ("clean_client: client_data = %p\n",
(void *) client_data));
-
+
if (client_data->expiration < time(0)) {
PRINTF(("clean_client: client %d expired\n",
client_data->key));
@@ -926,28 +926,28 @@ bool_t svcauth_gssapi_set_names(
OM_uint32 gssstat, minor_stat;
gss_buffer_desc in_buf;
int i;
-
+
if (num == 0)
for (; names[num].name != NULL; num++)
;
server_creds_list = NULL;
server_name_list = NULL;
-
+
server_creds_list = (gss_cred_id_t *) malloc(num*sizeof(gss_cred_id_t));
if (server_creds_list == NULL)
goto fail;
server_name_list = (gss_name_t *) malloc(num*sizeof(gss_name_t));
if (server_name_list == NULL)
goto fail;
-
+
for (i = 0; i < num; i++) {
server_name_list[i] = 0;
server_creds_list[i] = 0;
}
server_creds_count = num;
-
+
for (i = 0; i < num; i++) {
in_buf.value = names[i].name;
in_buf.length = strlen(in_buf.value) + 1;
@@ -955,8 +955,8 @@ bool_t svcauth_gssapi_set_names(
PRINTF(("svcauth_gssapi_set_names: importing %s\n", names[i].name));
gssstat = gss_import_name(&minor_stat, &in_buf, names[i].type,
- &server_name_list[i]);
-
+ &server_name_list[i]);
+
if (gssstat != GSS_S_COMPLETE) {
AUTH_GSSAPI_DISPLAY_STATUS(("importing name", gssstat,
minor_stat));