cleanup, test naming exts

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/authdata@22595 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/include/k5-int.h b/src/include/k5-int.h
index 7b521ff281bcec93402ec1d3c3dfb016528a52f3..22c0b4a047cc1cf9454fe9c786ba8c2a0a327089 100644 (file)
--- a/src/include/k5-int.h
+++ b/src/include/k5-int.h
@@ -1396,6 +1396,7 @@ krb5_error_code KRB5_CALLCONV krb5_authdata_export_attributes
 krb5_error_code KRB5_CALLCONV krb5_authdata_export_internal
 (krb5_context kcontext,
  krb5_authdata_context context,
+ krb5_boolean restrict_authenticated,
  const char *module,
  void **ptr);
 

diff --git a/src/include/krb5/authdata_plugin.h b/src/include/krb5/authdata_plugin.h
index 4cd3639e560d46cd1d07a0577c673d4752818a22..6a5e73914e88bb8a3becd22c352c7d2eae203314 100644 (file)
--- a/src/include/krb5/authdata_plugin.h
+++ b/src/include/krb5/authdata_plugin.h
@@ -238,6 +238,7 @@ typedef krb5_error_code
 (*authdata_client_export_internal_proc)(krb5_context context,
                                        void *plugin_context,
                                        void *request_context,
+                                       krb5_boolean restrict_authenticated,
                                        void **ptr);
 
 /* NB: this takes ownership of ptr */

diff --git a/src/lib/gssapi/generic/gssapi_ext.h b/src/lib/gssapi/generic/gssapi_ext.h
index eb6a23cc13de7fa5b8200049efcc7deab9af4a65..f7c35acfd495c5c9081fc2a4bffb2501ed2e5217 100644 (file)
--- a/src/lib/gssapi/generic/gssapi_ext.h
+++ b/src/lib/gssapi/generic/gssapi_ext.h
@@ -254,8 +254,82 @@ OM_uint32 KRB5_CALLCONV gss_release_iov_buffer
     gss_iov_buffer_desc *, /* iov */
     int);              /* iov_count */
 
+/*
+ * Naming extensions
+ */
+OM_uint32 KRB5_CALLCONV gss_display_name_ext
+(
+    OM_uint32 *,       /* minor_status */
+    gss_name_t,                /* name */
+    gss_OID,           /* display_as_name_type */
+    gss_buffer_t       /* display_name */
+);
+
+OM_uint32 KRB5_CALLCONV gss_inquire_name
+(
+    OM_uint32 *,       /* minor_status */
+    gss_name_t,                /* name */
+    int *,             /* name_is_MN */
+    gss_OID *,         /* MN_mech */
+    gss_buffer_set_t *,        /* authenticated */
+    gss_buffer_set_t *,        /* asserted */
+    gss_buffer_set_t * /* complete */
+);
+
+OM_uint32 KRB5_CALLCONV gss_get_name_attribute
+(
+    OM_uint32 *,       /* minor_status */
+    gss_name_t,                /* name */
+    gss_buffer_t,      /* attr */
+    int *,             /* authenticated */
+    int *,             /* complete */
+    gss_buffer_t,      /* value */
+    gss_buffer_t,      /* display_value */
+    int *              /* more */
+);
+
+OM_uint32 KRB5_CALLCONV gss_set_name_attribute
+(
+    OM_uint32 *,       /* minor_status */
+    gss_name_t,                /* name */
+    int,               /* complete */
+    gss_buffer_t,      /* attr */
+    gss_buffer_t       /* value */
+);
+
+OM_uint32 KRB5_CALLCONV gss_delete_name_attribute
+(
+    OM_uint32 *,       /* minor_status */
+    gss_name_t,                /* name */
+    gss_buffer_t       /* attr */
+);
+
+OM_uint32 KRB5_CALLCONV gss_export_name_composite
+(
+    OM_uint32 *,       /* minor_status */
+    gss_name_t,                /* name */
+    gss_buffer_t       /* exp_composite_name */
+);
+
 typedef struct gss_any *gss_any_t;
 
+OM_uint32 KRB5_CALLCONV gss_map_name_to_any
+(
+    OM_uint32 *,       /* minor_status */
+    gss_name_t,                /* name */
+    int,               /* authenticated */
+    gss_buffer_t,      /* type_id */
+    gss_any_t *                /* output */
+);
+
+OM_uint32 KRB5_CALLCONV gss_release_any_name_mapping
+(
+    OM_uint32 *,       /* minor_status */
+    gss_name_t,                /* name */
+    gss_buffer_t,      /* type_id */
+    gss_any_t *                /* input */
+);
+
 #ifdef __cplusplus
 }
 #endif

diff --git a/src/lib/gssapi/krb5/gssapiP_krb5.h b/src/lib/gssapi/krb5/gssapiP_krb5.h
index 3e5a52d5714e6f8b8e0cb5abf95df5c557d7e56b..69abf9f0b3dd05bfd988205a2583515f19f1b7b7 100644 (file)
--- a/src/lib/gssapi/krb5/gssapiP_krb5.h
+++ b/src/lib/gssapi/krb5/gssapiP_krb5.h
@@ -821,6 +821,61 @@ kg_compare_name(krb5_context context,
                 krb5_gss_name_t name1,
                 krb5_gss_name_t name2);
 
+OM_uint32
+krb5_gss_display_name_ext(OM_uint32 *minor_status,
+                          gss_name_t name,
+                          gss_OID display_as_name_type,
+                          gss_buffer_t display_name);
+
+OM_uint32
+krb5_gss_inquire_name(OM_uint32 *minor_status,
+                      gss_name_t name,
+                      int *name_is_MN,
+                      gss_OID *MN_mech,
+                      gss_buffer_set_t *authenticated,
+                      gss_buffer_set_t *asserted,
+                      gss_buffer_set_t *complete);
+
+OM_uint32
+krb5_gss_get_name_attribute(OM_uint32 *minor_status,
+                            gss_name_t name,
+                            gss_buffer_t attr,
+                            int *authenticated,
+                            int *complete,
+                            gss_buffer_t value,
+                            gss_buffer_t display_value,
+                            int *more);
+
+OM_uint32
+krb5_gss_set_name_attribute(OM_uint32 *minor_status,
+                            gss_name_t name,
+                            int complete,
+                            gss_buffer_t attr,
+                            gss_buffer_t value);
+
+OM_uint32
+krb5_gss_delete_name_attribute(OM_uint32 *minor_status,
+                               gss_name_t name,
+                               gss_buffer_t attr);
+
+OM_uint32
+krb5_gss_export_name_composite(OM_uint32 *minor_status,
+                               gss_name_t name,
+                               gss_buffer_t exp_composite_name);
+
+OM_uint32
+krb5_gss_map_name_to_any(OM_uint32 *minor_status,
+                         gss_name_t name,
+                         int authenticated,
+                         gss_buffer_t type_id,
+                         gss_any_t *output);
+
+OM_uint32
+krb5_gss_release_any_name_mapping(OM_uint32 *minor_status,
+                                  gss_name_t name,
+                                  gss_buffer_t type_id,
+                                  gss_any_t *input);
+
 /*
  * These take unglued krb5-mech-specific contexts.
  */

diff --git a/src/lib/gssapi/krb5/gssapi_krb5.c b/src/lib/gssapi/krb5/gssapi_krb5.c
index a20e59dfb4c4f7f7441e79b3052fcc8d012ea22c..0fab4e454bbb52cf84a9e1411bde18ab128f35db 100644 (file)
--- a/src/lib/gssapi/krb5/gssapi_krb5.c
+++ b/src/lib/gssapi/krb5/gssapi_krb5.c
@@ -683,6 +683,14 @@ static struct gss_config krb5_mechanism = {
     krb5_gss_unwrap_iov,
     krb5_gss_wrap_iov_length,
     NULL,               /* complete_auth_token */
+    NULL,               /* display_name_ext */
+    krb5_gss_inquire_name,
+    krb5_gss_get_name_attribute,
+    krb5_gss_set_name_attribute,
+    krb5_gss_delete_name_attribute,
+    NULL,               /* export_name_composite */
+    krb5_gss_map_name_to_any,
+    krb5_gss_release_any_name_mapping,
 };
 
 

diff --git a/src/lib/gssapi/krb5/naming_exts.c b/src/lib/gssapi/krb5/naming_exts.c
index 66a89e5fc95bc4e5fe7cdfc331fc8c5f79fe3960..a4cdc26b4b2f3cd8e44c21efbda2c17afc7ca4c2 100644 (file)
--- a/src/lib/gssapi/krb5/naming_exts.c
+++ b/src/lib/gssapi/krb5/naming_exts.c
@@ -189,7 +189,7 @@ kg_data_list_to_buffer_set_nocopy(krb5_data **pdata,
 OM_uint32
 krb5_gss_inquire_name(OM_uint32 *minor_status,
                       gss_name_t name,
-                      int name_is_MN,
+                      int *name_is_MN,
                       gss_OID *MN_mech,
                       gss_buffer_set_t *authenticated,
                       gss_buffer_set_t *asserted,
@@ -306,18 +306,24 @@ krb5_gss_get_name_attribute(OM_uint32 *minor_status,
                                        &kattr,
                                        &kauthenticated,
                                        &kcomplete,
-                                       &kvalue,
-                                       &kdisplay_value,
+                                       value ? &kvalue : NULL,
+                                       display_value ? &kdisplay_value : NULL,
                                        more);
     if (code == 0) {
-        value->value = kvalue.data;
-        value->length = kvalue.length;
+        if (value != NULL) {
+            value->value = kvalue.data;
+            value->length = kvalue.length;
+        }
 
-        *authenticated = kauthenticated;
-        *complete = kcomplete;
+        if (authenticated != NULL)
+            *authenticated = kauthenticated;
+        if (complete != NULL)
+            *complete = kcomplete;
 
-        display_value->value = kvalue.data;
-        display_value->length = kvalue.length;
+        if (display_value != NULL) {
+            display_value->value = kdisplay_value.data;
+            display_value->length = kdisplay_value.length;
+        }
     }
 
     krb5_free_context(context);
@@ -460,6 +466,7 @@ krb5_gss_map_name_to_any(OM_uint32 *minor_status,
 
     code = krb5_authdata_export_internal(context,
                                          kname->ad_context,
+                                         authenticated,
                                          kmodule,
                                          (void **)output);
 

diff --git a/src/lib/gssapi/libgssapi_krb5.exports b/src/lib/gssapi/libgssapi_krb5.exports
index 69f390e4514a944628eefd76a48f49c6a921d50d..8d560cecf43022d6efe6485d000d53de62944d3f 100644 (file)
--- a/src/lib/gssapi/libgssapi_krb5.exports
+++ b/src/lib/gssapi/libgssapi_krb5.exports
@@ -18,13 +18,17 @@ gss_complete_auth_token
 gss_context_time
 gss_create_empty_buffer_set
 gss_create_empty_oid_set
+gss_delete_name_attribute
 gss_delete_sec_context
 gss_display_name
+gss_display_name_ext
 gss_display_status
 gss_duplicate_name
 gss_export_name
+gss_export_name_composite
 gss_export_sec_context
 gss_get_mic
+gss_get_name_attribute
 gss_import_name
 gss_import_sec_context
 gss_indicate_mechs
@@ -47,6 +51,7 @@ gss_krb5int_make_seal_token_v3
 gss_krb5int_unseal_token_v3
 gsskrb5_extract_authtime_from_sec_context
 gsskrb5_extract_authz_data_from_sec_context
+gss_map_name_to_any
 gss_mech_krb5
 gss_mech_krb5_old
 gss_mech_set_krb5
@@ -62,6 +67,7 @@ gss_nt_string_uid_name
 gss_nt_user_name
 gss_oid_to_str
 gss_process_context_token
+gss_release_any_name_mapping
 gss_release_buffer_set
 gss_release_buffer
 gss_release_cred
@@ -70,6 +76,7 @@ gss_release_name
 gss_release_oid
 gss_release_oid_set
 gss_seal
+gss_set_name_attribute
 gss_set_sec_context_option
 gss_sign
 gss_str_to_oid
@@ -90,3 +97,4 @@ gssspi_mech_invoke
 krb5_gss_dbg_client_expcreds
 krb5_gss_register_acceptor_identity
 krb5_gss_use_kdc_context
+gss_inquire_name

diff --git a/src/lib/krb5/krb/authdata.c b/src/lib/krb5/krb/authdata.c
index 3d6c4809211d72bd2d7244bf97aa6819babd6e69..4b6df0bbbcf6b46ad46b4fba26c86afbecb41761 100644 (file)
--- a/src/lib/krb5/krb/authdata.c
+++ b/src/lib/krb5/krb/authdata.c
@@ -532,6 +532,9 @@ krb5_authdata_export_attributes(krb5_context kcontext,
         krb5_authdata **authdata2 = NULL;
         int j;
 
+        if ((module->flags & flags) == 0)
+            continue;
+
         if (module->ftable->export_attributes == NULL)
             continue;
 
@@ -566,6 +569,7 @@ krb5_authdata_export_attributes(krb5_context kcontext,
 krb5_error_code KRB5_CALLCONV
 krb5_authdata_export_internal(krb5_context kcontext,
                               krb5_authdata_context context,
+                              krb5_boolean restrict_authenticated,
                               const char *module_name,
                               void **ptr)
 {
@@ -586,6 +590,7 @@ krb5_authdata_export_internal(krb5_context kcontext,
         code = (*module->ftable->export_internal)(kcontext,
                                                   module->plugin_context,
                                                   *(module->request_context_pp),
+                                                  restrict_authenticated,
                                                   ptr);
 
         break;
@@ -695,6 +700,7 @@ import_export_authdata(krb5_context kcontext,
     code = (*src_module->ftable->export_internal)(kcontext,
                                                   src_module->plugin_context,
                                                   *(src_module->request_context_pp),
+                                                  FALSE,
                                                   &ptr);
     if (code != 0)
         return code;

diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c
index e87127c349702727e693ad54384cb5a0d0b91ed0..88fd95a1739e737d96a91724c3e3581fb3c2e4ef 100644 (file)
--- a/src/lib/krb5/krb/pac.c
+++ b/src/lib/krb5/krb/pac.c
@@ -916,16 +916,10 @@ mspac_fini(krb5_context context, void *plugin_context)
 static krb5_error_code
 mspac_request_init(krb5_context context,
                   void *plugin_context,
-                  krb5_flags usage,
                   void **request_context)
 {
     struct mspac_context *pacctx;
 
-    if ((usage & AD_USAGE_AP_REQ) == 0) {
-       *request_context = NULL;
-       return 0;
-    }
-
     pacctx = (struct mspac_context *)malloc(sizeof(*pacctx));
     if (pacctx == NULL)
        return ENOMEM;
@@ -1149,8 +1143,10 @@ mspac_get_attribute(krb5_context context,
     value->data = NULL;
     value->length = 0;
 
-    display_value->data = NULL;
-    display_value->length = 0;
+    if (display_value != NULL) {
+        display_value->data = NULL;
+        display_value->length = 0;
+    }
 
     if (*more != -1 || pacctx->pac == NULL)
        return ENOENT;
@@ -1160,10 +1156,19 @@ mspac_get_attribute(krb5_context context,
        return code;
 
     /* -1 is a magic type that refers to the entire PAC */
-    if (type == (krb5_ui_4)-1)
-       code = krb5int_copy_data_contents(context, &pacctx->pac->data, value);
-    else
-       code = krb5_pac_get_buffer(context, pacctx->pac, type, value);
+    if (type == (krb5_ui_4)-1) {
+        if (value != NULL)
+           code = krb5int_copy_data_contents(context,
+                                              &pacctx->pac->data,
+                                              value);
+        else
+            code = 0;
+    } else {
+        if (value != NULL)
+           code = krb5_pac_get_buffer(context, pacctx->pac, type, value);
+        else
+            code = k5_pac_locate_buffer(context, pacctx->pac, type, NULL);
+    }
     if (code == 0) {
        *authenticated = pacctx->pac->verified;
        *complete = TRUE;
@@ -1214,6 +1219,7 @@ static krb5_error_code
 mspac_export_attributes(krb5_context context,
                        void *plugin_context,
                        void *request_context,
+                       krb5_flags usage,
                        krb5_authdata ***out_authdata)
 {
     struct mspac_context *pacctx = (struct mspac_context *)request_context;
@@ -1253,14 +1259,20 @@ static krb5_error_code
 mspac_export_internal(krb5_context context,
                      void *plugin_context,
                      void *request_context,
+                      krb5_boolean restrict_authenticated,
                      void **ptr)
 {
     struct mspac_context *pacctx = (struct mspac_context *)request_context;
     krb5_error_code code;
     krb5_pac pac;
 
+    *ptr = NULL;
+
     if (pacctx->pac == NULL)
-       return EINVAL;
+       return 0;
+
+    if (restrict_authenticated && (pacctx->pac->verified) == FALSE)
+        return 0;
 
     code = krb5_pac_parse(context, pacctx->pac->data.data,
                          pacctx->pac->data.length, &pac);

diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c
index cab4de8b616e2702df5be485177edeabc07037b8..1dcfdc24d389e85faebbae3a3ce1c4d8b64fed35 100644 (file)
--- a/src/lib/krb5/krb/rd_req_dec.c
+++ b/src/lib/krb5/krb/rd_req_dec.c
@@ -410,7 +410,6 @@ krb5_rd_req_decoded_opt(krb5_context context, krb5_auth_context *auth_context,
                                            req,
                                            0)))
         goto cleanup;
-      krb5_authdata_debug(context, *ad_context);
     }
 
     /* read RFC 4537 etype list from sender */

diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports
index 20b0053cfe41c002cdb6c8a56e7d699f51b7798b..bd0816c0aa935d4ddb13c9a6fd4bdca37d43182a 100644 (file)
--- a/src/lib/krb5/libkrb5.exports
+++ b/src/lib/krb5/libkrb5.exports
@@ -136,6 +136,7 @@ krb5_auth_to_rep
 krb5_authdata_context_copy
 krb5_authdata_context_free
 krb5_authdata_context_init
+krb5_authdata_delete_attribute
 krb5_authdata_get_attribute_types
 krb5_authdata_get_attribute
 krb5_authdata_set_attribute

diff --git a/src/tests/gssapi/t_namingexts.c b/src/tests/gssapi/t_namingexts.c
index 8f2fc1fb88c5d5bff60c9902e5b98f8189a29640..88293499035a9a01d06f6eb5d69cb5650acc6785 100644 (file)
--- a/src/tests/gssapi/t_namingexts.c
+++ b/src/tests/gssapi/t_namingexts.c
@@ -89,6 +89,101 @@ displayCanonName(OM_uint32 *minor, gss_name_t name, char *tag)
     return GSS_S_COMPLETE;
 }
 
+static void
+dumpAttribute(OM_uint32 *minor,
+              gss_name_t name,
+              gss_buffer_t attribute)
+{
+    OM_uint32 major, tmp;
+    gss_buffer_desc value;
+    gss_buffer_desc display_value;
+    int authenticated = 0;
+    int complete = 0;
+    int more = -1;
+    unsigned int i;
+
+    while (more != 0) {
+        value.value = NULL;
+        display_value.value = NULL;
+
+        major = gss_get_name_attribute(minor,
+                                       name,
+                                       attribute,
+                                       &authenticated,
+                                       &complete,
+                                       &value,
+                                       &display_value,
+                                       &more);
+        if (GSS_ERROR(major)) {
+            displayStatus("gss_get_name_attribute", major, minor);
+            break;
+        }
+
+        printf("\nAttribute %.*s %s %s %.*s\n",
+               (int)attribute->length, (char *)attribute->value,
+               authenticated ? "Authenticated" : "",
+                complete ? "Complete" : "",
+               (int)display_value.length, (char *)display_value.value);
+
+        for (i = 0; i < value.length; i++) {
+            if ((i % 32) == 0)
+                printf("\n");
+            printf("%02x", ((char *)value.value)[i] & 0xFF);
+        }
+
+        printf("\n");
+
+        gss_release_buffer(&tmp, &value);
+        gss_release_buffer(&tmp, &display_value);
+    }
+}
+
+static OM_uint32
+enumerateAttributes(OM_uint32 *minor,
+                    gss_name_t name)
+{
+    OM_uint32 major, tmp;
+    int name_is_MN;
+    gss_OID mech = GSS_C_NO_OID;
+    gss_buffer_set_t authenticated = GSS_C_NO_BUFFER_SET;
+    gss_buffer_set_t asserted = GSS_C_NO_BUFFER_SET;
+    gss_buffer_set_t complete = GSS_C_NO_BUFFER_SET;
+    unsigned int i;
+
+    major = gss_inquire_name(minor,
+                             name,
+                             &name_is_MN,
+                             &mech,
+                             &authenticated,
+                             &asserted,
+                             &complete);
+    if (GSS_ERROR(major)) {
+        displayStatus("gss_inquire_name", major, minor);
+        goto cleanup;
+    }
+
+    if (authenticated != GSS_C_NO_BUFFER_SET) {
+        for (i = 0; i < authenticated->count; i++)
+            dumpAttribute(minor, name, &authenticated->elements[i]);
+    }
+    if (asserted != GSS_C_NO_BUFFER_SET) {
+        for (i = 0; i < authenticated->count; i++)
+            dumpAttribute(minor, name, &asserted->elements[i]);
+    }
+    if (complete != GSS_C_NO_BUFFER_SET) {
+        for (i = 0; i < authenticated->count; i++)
+            dumpAttribute(minor, name, &complete->elements[i]);
+    }
+
+cleanup:
+    gss_release_oid(&tmp, &mech);
+    gss_release_buffer_set(&tmp, &authenticated);
+    gss_release_buffer_set(&tmp, &asserted);
+    gss_release_buffer_set(&tmp, &complete);
+
+    return major;
+}
+
 static OM_uint32
 initAcceptSecContext(OM_uint32 *minor,
                      gss_cred_id_t verifier_cred_handle,
@@ -157,8 +252,10 @@ initAcceptSecContext(OM_uint32 *minor,
 
     if (GSS_ERROR(major))
         displayStatus("gss_accept_sec_context", major, minor);
-    else
+    else {
         displayCanonName(minor, source_name, "Source name");
+        enumerateAttributes(minor, source_name);
+    }
 
     (void) gss_delete_sec_context(minor, &acceptor_context, NULL);
     (void) gss_release_buffer(minor, &token);