C++ gss_release_oid_set函数代码示例

static OM_uint32 get_local_def_creds(OM_uint32 *minor_status,
                                     struct gpp_name_handle *name,
                                     gss_cred_usage_t cred_usage,
                                     struct gpp_cred_handle *cred_handle)
{
    gss_OID_set interposed_mechs = GSS_C_NO_OID_SET;
    gss_OID_set special_mechs = GSS_C_NO_OID_SET;
    OM_uint32 maj, min;

    maj = GSS_S_FAILURE;
    min = 0;

    interposed_mechs = gss_mech_interposer((gss_OID)&gssproxy_mech_interposer);
    if (interposed_mechs == GSS_C_NO_OID_SET) {
        goto done;
    }
    special_mechs = gpp_special_available_mechs(interposed_mechs);
    if (special_mechs == GSS_C_NO_OID_SET) {
        goto done;
    }

    maj = gss_acquire_cred(&min, name ? name->local : NULL, 0, special_mechs,
                           cred_usage, &cred_handle->local, NULL, NULL);
done:
    *minor_status = min;
    (void)gss_release_oid_set(&min, &special_mechs);
    (void)gss_release_oid_set(&min, &interposed_mechs);
    return maj;
}

/* Privileged (called from ssh_gssapi_server_ctx) */
static OM_uint32
ssh_gssapi_acquire_cred(Gssctxt *ctx)
{
	OM_uint32 status;
	char lname[NI_MAXHOST];
	gss_OID_set oidset;

	gss_create_empty_oid_set(&status, &oidset);
	gss_add_oid_set_member(&status, ctx->oid, &oidset);

	if (gethostname(lname, sizeof(lname))) {
		gss_release_oid_set(&status, &oidset);
		return (-1);
	}

	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
		gss_release_oid_set(&status, &oidset);
		return (ctx->major);
	}

	if ((ctx->major = gss_acquire_cred(&ctx->minor,
	    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
		ssh_gssapi_error(ctx);

	gss_release_oid_set(&status, &oidset);
	return (ctx->major);
}

/* Privileged (called from ssh_gssapi_server_ctx) */
static OM_uint32
ssh_gssapi_acquire_cred(Gssctxt *ctx)
{
	OM_uint32 status;
	char lname[NI_MAXHOST];
	gss_OID_set oidset;

	if (options.gss_strict_acceptor) {
		gss_create_empty_oid_set(&status, &oidset);
		gss_add_oid_set_member(&status, ctx->oid, &oidset);

		if (gethostname(lname, MAXHOSTNAMELEN)) {
			gss_release_oid_set(&status, &oidset);
			return (-1);
		}

		if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
			gss_release_oid_set(&status, &oidset);
			return (ctx->major);
		}

		if ((ctx->major = gss_acquire_cred(&ctx->minor,
		    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds,
		    NULL, NULL)))
			ssh_gssapi_error(ctx);

		gss_release_oid_set(&status, &oidset);
		return (ctx->major);
	} else {
		ctx->name = GSS_C_NO_NAME;
		ctx->creds = GSS_C_NO_CREDENTIAL;
	}
	return GSS_S_COMPLETE;
}

static OM_uint32
spnego_supported_mechs(OM_uint32 *minor_status, gss_OID_set *mechs)
{
    OM_uint32 ret, junk;
    gss_OID_set m;
    size_t i;

    ret = gss_indicate_mechs(minor_status, &m);
    if (ret != GSS_S_COMPLETE)
	return ret;

    ret = gss_create_empty_oid_set(minor_status, mechs);
    if (ret != GSS_S_COMPLETE) {
	gss_release_oid_set(&junk, &m);
	return ret;
    }

    for (i = 0; i < m->count; i++) {
	if (gss_oid_equal(&m->elements[i], GSS_SPNEGO_MECHANISM))
	    continue;

	ret = gss_add_oid_set_member(minor_status, &m->elements[i], mechs);
	if (ret) {
	    gss_release_oid_set(&junk, &m);
	    gss_release_oid_set(&junk, mechs);
	    return ret;
	}
    }
    gss_release_oid_set(&junk, &m);
    return ret;
}

OM_uint32 gss_indicate_mechs
           (OM_uint32 * minor_status,
            gss_OID_set * mech_set
           )
{
  OM_uint32 ret;

  ret = gss_create_empty_oid_set(minor_status, mech_set);
  if (ret)
      return ret;

  ret = gss_add_oid_set_member(minor_status, GSS_KRB5_MECHANISM, mech_set);
  if (ret) {
      gss_release_oid_set(NULL, mech_set);
      return ret;
  }

  ret = gss_add_oid_set_member(minor_status, GSS_SPNEGO_MECHANISM, mech_set);
  if (ret) {
      gss_release_oid_set(NULL, mech_set);
      return ret;
  }

  *minor_status = 0;
  return GSS_S_COMPLETE;
}

OM_uint32
gssEapDefaultMech(OM_uint32 *minor,
                  gss_OID *oid)
{
    gss_OID_set mechs;
    OM_uint32 major, tmpMinor;

    major = gssEapIndicateMechs(minor, &mechs);
    if (GSS_ERROR(major)) {
        return major;
    }

    if (mechs->count == 0) {
        gss_release_oid_set(&tmpMinor, &mechs);
        return GSS_S_BAD_MECH;
    }

    if (!internalizeOid(&mechs->elements[0], oid)) {
        /* don't double-free if we didn't internalize it */
        mechs->elements[0].length = 0;
        mechs->elements[0].elements = NULL;
    }

    gss_release_oid_set(&tmpMinor, &mechs);

    *minor = 0;
    return GSS_S_COMPLETE;
}

static
OM_uint32 dumpMechAttrs(OM_uint32 *minor, gss_OID mech)
{
    OM_uint32 major, tmpMinor;
    gss_OID_set mech_attrs = GSS_C_NO_OID_SET;
    gss_OID_set known_attrs = GSS_C_NO_OID_SET;
    size_t i;

    major = gss_inquire_attrs_for_mech(minor, mech, &mech_attrs, &known_attrs);
    if (GSS_ERROR(major)) {
        displayStatus("gss_inquire_attrs_for_mech", major, *minor);
        return major;
    }

    printf("Mech attrs:  ");

    for (i = 0; i < mech_attrs->count; i++) {
        gss_buffer_desc name = GSS_C_EMPTY_BUFFER;
        gss_buffer_desc short_desc = GSS_C_EMPTY_BUFFER;
        gss_buffer_desc long_desc = GSS_C_EMPTY_BUFFER;

        major = gss_display_mech_attr(minor, &mech_attrs->elements[i],
                                      &name, &short_desc, &long_desc);
        if (GSS_ERROR(major)) {
            displayStatus("gss_display_mech_attr", major, *minor);
            continue;
        }
        printf("%.*s ", (int)name.length, (char *)name.value);
        gss_release_buffer(minor, &name);
        gss_release_buffer(minor, &short_desc);
        gss_release_buffer(minor, &long_desc);
    }
    printf("\n");

    printf("Known attrs: ");

    for (i = 0; i < known_attrs->count; i++) {
        gss_buffer_desc name = GSS_C_EMPTY_BUFFER;
        gss_buffer_desc short_desc = GSS_C_EMPTY_BUFFER;
        gss_buffer_desc long_desc = GSS_C_EMPTY_BUFFER;

        major = gss_display_mech_attr(minor, &known_attrs->elements[i],
                                      &name, &short_desc, &long_desc);
        if (GSS_ERROR(major)) {
            displayStatus("gss_display_mech_attr", major, *minor);
            continue;
        }
        printf("%.*s ", (int)name.length, (char *)name.value);
        gss_release_buffer(minor, &name);
        gss_release_buffer(minor, &short_desc);
        gss_release_buffer(minor, &long_desc);
    }
    printf("\n");

    gss_release_oid_set(&tmpMinor, &mech_attrs);
    gss_release_oid_set(&tmpMinor, &known_attrs);

    return GSS_S_COMPLETE;
}

/*
 * Translate an OID_set from the local GSS-API library's ABI into the
 * ABI which SAP expects.  This translation routine is only used within
 * this shim adapter, so it is appropriate for the this routine to release
 * the storage which was allocated by the GSS-API library (since that
 * storage will never be exposed to the application and will otherwise be
 * leaked).
 *
 * Returns 0 on success, errno on failure.
 */
static int
gss_OID_set_loc_to_sap(gss_OID_set loc, sapgss_OID_set *sap)
{
    sapgss_OID s;
    gss_OID e;
    size_t i;
    uint32_t dummy;

    if (sap == NULL)
	return 0;
    if (loc == NULL) {
	*sap = NULL;
	return 0;
    }

    *sap = calloc(1, sizeof(**sap));
    if (*sap == NULL)
	return errno;
    (*sap)->elements = calloc(loc->count, sizeof(sapgss_OID_desc));
    if ((*sap)->elements == NULL) {
	free(*sap);
	*sap = NULL;
	return ENOMEM;
    }
    for(i = 0; i < loc->count; ++i) {
	e = &loc->elements[i];
	s = &(*sap)->elements[i];
	s->elements = malloc(e->length);
	if (s->elements == NULL)
	    goto looperr;
	memcpy(s->elements, e->elements, e->length);
	s->length = e->length;
    }
    (*sap)->count = loc->count;
    (void)gss_release_oid_set(&dummy, &loc);
    return 0;

looperr:
    for(i = 0; i < loc->count; ++i) {
	s = &(*sap)->elements[i];
	if (s->elements == NULL)
	    break;
	free(s->elements);
    }
    free((*sap)->elements);
    free(*sap);
    *sap = NULL;
    (void)gss_release_oid_set(&dummy, &loc);
    return ENOMEM;
}

/* Unprivileged */
void
ssh_gssapi_supported_oids(gss_OID_set *oidset)
{
	int i = 0;
	OM_uint32 min_status;
	int present;
	gss_OID_set supported;

	gss_create_empty_oid_set(&min_status, oidset);

	if (GSS_ERROR(gss_indicate_mechs(&min_status, &supported)))
		return;

	while (supported_mechs[i]->name != NULL) {
		if (GSS_ERROR(gss_test_oid_set_member(&min_status,
		    &supported_mechs[i]->oid, supported, &present)))
			present = 0;
		if (present)
			gss_add_oid_set_member(&min_status,
			    &supported_mechs[i]->oid, oidset);
		i++;
	}

	gss_release_oid_set(&min_status, &supported);
}

int listMechanisms(int argc, char* argv[])
{
    OM_uint32 major, minor;
    gss_OID_set mechanisms;
    int index,i;
    gss_OID currElem = NULL;
    printf("\tListing available mechanisms\n");

    major = gss_indicate_mechs(&minor, &mechanisms);
    checkError(major, minor, "gss_indicate_mechs");
    printf("\tFound %zu elements:\n", mechanisms->count);
    for(index = 0; index < mechanisms->count; index++) {
        currElem = &(mechanisms->elements[index]);
        printf("\t{ %d,", currElem->length);
        for(i = 0; i < currElem->length; i++)
            printf("\\x%x", ((char *)currElem->elements)[i]);
        printf("}\n");
        printOid(currElem);
    }

    if (major != GSS_S_COMPLETE) {
        fprintf(stderr, "failed to get the mechanisms ");
        return 1;
    }

    printf("\tfreeing the oidset..\n");
    major = gss_release_oid_set(&minor, &mechanisms);
    checkError(major, minor, "gss_release_oid_set");
    return 0;
}

static apr_status_t mag_oid_set_destroy(void *ptr)
{
    uint32_t min;
    gss_OID_set set = (gss_OID_set)ptr;
    (void)gss_release_oid_set(&min, &set);
    return APR_SUCCESS;
}

/* Return true if mech should be accepted with no acceptor credential. */
static int
allow_mech_by_default(gss_OID mech)
{
    OM_uint32 status, minor;
    gss_OID_set attrs;
    int reject = 0, p;

    /* Whether we accept an interposer mech depends on whether we accept the
     * mech it interposes. */
    mech = gssint_get_public_oid(mech);
    if (mech == GSS_C_NO_OID)
	return 0;

    status = gss_inquire_attrs_for_mech(&minor, mech, &attrs, NULL);
    if (status)
	return 0;

    /* Check for each attribute which would cause us to exclude this mech from
     * the default credential. */
    if (generic_gss_test_oid_set_member(&minor, GSS_C_MA_DEPRECATED,
					attrs, &p) != GSS_S_COMPLETE || p)
	reject = 1;
    else if (generic_gss_test_oid_set_member(&minor, GSS_C_MA_NOT_DFLT_MECH,
					     attrs, &p) != GSS_S_COMPLETE || p)
	reject = 1;

    (void) gss_release_oid_set(&minor, &attrs);
    return !reject;
}

OM_uint32 _gsskrb5_inquire_names_for_mech (
            OM_uint32 * minor_status,
            const gss_OID mechanism,
            gss_OID_set * name_types
           )
{
    OM_uint32 ret;
    int i;

    *minor_status = 0;

    if (gss_oid_equal(mechanism, GSS_KRB5_MECHANISM) == 0 &&
	gss_oid_equal(mechanism, GSS_C_NULL_OID) == 0) {
	*name_types = GSS_C_NO_OID_SET;
	return GSS_S_BAD_MECH;
    }

    ret = gss_create_empty_oid_set(minor_status, name_types);
    if (ret != GSS_S_COMPLETE)
	return ret;

    for (i = 0; name_list[i] != NULL; i++) {
	ret = gss_add_oid_set_member(minor_status,
				     *(name_list[i]),
				     name_types);
	if (ret != GSS_S_COMPLETE)
	    break;
    }

    if (ret != GSS_S_COMPLETE)
	gss_release_oid_set(NULL, name_types);
	
    return GSS_S_COMPLETE;
}

OM_uint32 gss_release_cred
           (OM_uint32 * minor_status,
            gss_cred_id_t * cred_handle
           )
{
    *minor_status = 0;

    if (*cred_handle == GSS_C_NO_CREDENTIAL) {
        return GSS_S_COMPLETE;
    }

    GSSAPI_KRB5_INIT ();

    HEIMDAL_MUTEX_lock(&(*cred_handle)->cred_id_mutex);

    if ((*cred_handle)->principal != NULL)
        krb5_free_principal(gssapi_krb5_context, (*cred_handle)->principal);
    if ((*cred_handle)->keytab != NULL)
	krb5_kt_close(gssapi_krb5_context, (*cred_handle)->keytab);
    if ((*cred_handle)->ccache != NULL) {
	const krb5_cc_ops *ops;
	ops = krb5_cc_get_ops(gssapi_krb5_context, (*cred_handle)->ccache);
	if (ops == &krb5_mcc_ops)
	    krb5_cc_destroy(gssapi_krb5_context, (*cred_handle)->ccache);
	else 
	    krb5_cc_close(gssapi_krb5_context, (*cred_handle)->ccache);
    }
    gss_release_oid_set(NULL, &(*cred_handle)->mechanisms);
    HEIMDAL_MUTEX_unlock(&(*cred_handle)->cred_id_mutex);
    HEIMDAL_MUTEX_destroy(&(*cred_handle)->cred_id_mutex);
    memset(*cred_handle, 0, sizeof(**cred_handle));
    free(*cred_handle);
    *cred_handle = GSS_C_NO_CREDENTIAL;
    return GSS_S_COMPLETE;
}

OM_uint32
ssh_gssapi_client_identity(Gssctxt *ctx, const char *name)
{
	gss_buffer_desc gssbuf;
	gss_name_t gssname;
	OM_uint32 status;
	gss_OID_set oidset;

	gssbuf.value = (void *) name;
	gssbuf.length = strlen(gssbuf.value);

	gss_create_empty_oid_set(&status, &oidset);
	gss_add_oid_set_member(&status, ctx->oid, &oidset);

	ctx->major = gss_import_name(&ctx->minor, &gssbuf,
	    GSS_C_NT_USER_NAME, &gssname);

	if (!ctx->major)
		ctx->major = gss_acquire_cred(&ctx->minor, 
		    gssname, 0, oidset, GSS_C_INITIATE, 
		    &ctx->client_creds, NULL, NULL);

	gss_release_name(&status, &gssname);
	gss_release_oid_set(&status, &oidset);

	if (ctx->major)
		ssh_gssapi_error(ctx);

	return(ctx->major);
}