Add an implementation of the RPCSEC_GSS authentication protocol for RPC. This

is based on an old implementation from the University of Michigan with lots of
changes and fixes by me and the addition of a Solaris-compatible API.

Sponsored by:	Isilon Systems
Reviewed by:	alfred

7 files changed, 99 insertions, 0 deletions

diff --git a/lib/libgssapi/Makefile b/lib/libgssapi/Makefile
index 5d4fef3..63d441c 100644
--- a/lib/libgssapi/Makefile
+++ b/lib/libgssapi/Makefile
@@ -40,6 +40,7 @@ SRCS+=		gss_inquire_sec_context_by_oid.c
 SRCS+=		gss_mech_switch.c
 SRCS+=		gss_names.c
 SRCS+=		gss_oid_to_str.c
+SRCS+=		gss_pname_to_uid.c
 SRCS+=		gss_process_context_token.c
 SRCS+=		gss_pseudo_random.c
 SRCS+=		gss_release_buffer.c
diff --git a/lib/libgssapi/Symbol.map b/lib/libgssapi/Symbol.map
index d2746da..6df8f0c 100644
--- a/lib/libgssapi/Symbol.map
+++ b/lib/libgssapi/Symbol.map
@@ -47,6 +47,7 @@ FBSD_1.1 {
 	gss_inquire_sec_context_by_oid;
 	gss_oid_equal;
 	gss_oid_to_str;
+	gss_pname_to_uid;
 	gss_process_context_token;
 	gss_pseudo_random;
 	gss_release_buffer;
@@ -67,3 +68,9 @@ FBSD_1.1 {
 	gss_wrap;
 	gss_wrap_size_limit;
 };
+
+FBSDprivate_1.0 {
+	_gss_copy_oid;
+	_gss_copy_buffer;
+	_gss_free_oid;
+};
diff --git a/lib/libgssapi/gss_mech_switch.c b/lib/libgssapi/gss_mech_switch.c
index f5808c5..feb88f1 100644
--- a/lib/libgssapi/gss_mech_switch.c
+++ b/lib/libgssapi/gss_mech_switch.c
@@ -285,6 +285,7 @@ _gss_load_mech(void)
 		OPTSYM(set_sec_context_option);
 		OPTSYM(set_cred_option);
 		OPTSYM(pseudo_random);
+		OPTSYM(pname_to_uid);
 
 		SLIST_INSERT_HEAD(&_gss_mechs, m, gm_link);
 		count++;
diff --git a/lib/libgssapi/gss_pname_to_uid.c b/lib/libgssapi/gss_pname_to_uid.c
new file mode 100644
index 0000000..eb560b9
--- /dev/null
+++ b/lib/libgssapi/gss_pname_to_uid.c
@@ -0,0 +1,69 @@
+/*-
+ * Copyright (c) 2008 Isilon Inc http://www.isilon.com/
+ * Authors: Doug Rabson <dfr@rabson.org>
+ * Developed with Red Inc: Alfred Perlstein <alfred@freebsd.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/* $FreeBSD$ */
+
+#include <unistd.h>
+#include <gssapi/gssapi.h>
+
+#include "mech_switch.h"
+#include "name.h"
+#include "utils.h"
+
+OM_uint32
+gss_pname_to_uid(OM_uint32 *minor_status, const gss_name_t pname,
+    const gss_OID mech, uid_t *uidp)
+{
+	struct _gss_name *name = (struct _gss_name *) pname;
+	struct _gss_mech_switch *m;
+	struct _gss_mechanism_name *mn;
+	OM_uint32 major_status;
+
+	*minor_status = 0;
+
+	if (pname == GSS_C_NO_NAME)
+		return (GSS_S_BAD_NAME);
+
+	m = _gss_find_mech_switch(mech);
+	if (!m)
+		return (GSS_S_BAD_MECH);
+
+	if (m->gm_pname_to_uid == NULL)
+		return (GSS_S_UNAVAILABLE);
+    
+	major_status = _gss_find_mn(minor_status, name, mech, &mn);
+	if (major_status != GSS_S_COMPLETE) {
+		_gss_mg_error(m, major_status, *minor_status);
+		return (major_status);
+	}
+
+	major_status = (*m->gm_pname_to_uid)(minor_status, mn->gmn_name,
+	    mech, uidp);
+	if (major_status != GSS_S_COMPLETE)
+		_gss_mg_error(m, major_status, *minor_status);
+
+	return (major_status);
+}
diff --git a/lib/libgssapi/gss_utils.c b/lib/libgssapi/gss_utils.c
index ec582a9..992908b 100644
--- a/lib/libgssapi/gss_utils.c
+++ b/lib/libgssapi/gss_utils.c
@@ -66,6 +66,18 @@ _gss_copy_oid(OM_uint32 *minor_status,
 	return (GSS_S_COMPLETE);
 }
 
+OM_uint32
+_gss_free_oid(OM_uint32 *minor_status, gss_OID oid)
+{
+
+	*minor_status = 0;
+	if (oid->elements) {
+		free(oid->elements);
+		oid->elements = NULL;
+		oid->length = 0;
+	}
+	return (GSS_S_COMPLETE);
+}
 
 OM_uint32
 _gss_copy_buffer(OM_uint32 *minor_status,
diff --git a/lib/libgssapi/mech_switch.h b/lib/libgssapi/mech_switch.h
index 876adcd..99e254e 100644
--- a/lib/libgssapi/mech_switch.h
+++ b/lib/libgssapi/mech_switch.h
@@ -304,6 +304,13 @@ typedef OM_uint32 _gss_pseudo_random
 	       gss_buffer_t	       /* PRF output */
 	      );
 
+typedef OM_uint32 _gss_pname_to_uid
+	      (OM_uint32 *,		/* minor status */
+	       gss_name_t pname,	/* principal name */
+	       gss_OID mech,		/* mechanism to query */
+	       uid_t *uidp		/* pointer to UID for result */
+	      );
+
 struct _gss_mech_switch {
 	SLIST_ENTRY(_gss_mech_switch)	gm_link;
 	const char			*gm_name_prefix;
@@ -343,6 +350,7 @@ struct _gss_mech_switch {
 	_gss_set_sec_context_option	*gm_set_sec_context_option;
 	_gss_set_cred_option		*gm_set_cred_option;
 	_gss_pseudo_random		*gm_pseudo_random;
+	_gss_pname_to_uid		*gm_pname_to_uid;
 };
 SLIST_HEAD(_gss_mech_switch_list, _gss_mech_switch);
 extern struct _gss_mech_switch_list _gss_mechs;
diff --git a/lib/libgssapi/utils.h b/lib/libgssapi/utils.h
index a54cb50..347b583 100644
--- a/lib/libgssapi/utils.h
+++ b/lib/libgssapi/utils.h
@@ -30,5 +30,6 @@
 	do { (buffer)->value = NULL; (buffer)->length = 0; } while(0)
 extern int _gss_oid_equal(const gss_OID, const gss_OID);
 extern OM_uint32 _gss_copy_oid(OM_uint32 *, const gss_OID, gss_OID);
+extern OM_uint32 _gss_free_oid(OM_uint32 *, gss_OID);
 extern OM_uint32 _gss_copy_buffer(OM_uint32 *minor_status,
     const gss_buffer_t from_buf, gss_buffer_t to_buf);