oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Update to use new decode/encode syntax.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@1952 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Johan Danielsson
1997-07-01 23:54:55 +00:00
parent 372881f5ef
commit 405d2be7c4
14 changed files with 195 additions and 186 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
kdc/connect.c
View File

@@ -59,20 +59,15 @@ process_request(krb5_context context,
{ {
KDC_REQ req; KDC_REQ req;
krb5_error_code err; krb5_error_code err;
int i; size_t i;
gettimeofday(&now, NULL); gettimeofday(&now, NULL);
if (maybe_AS_REQ(buf, len)){ if(decode_AS_REQ(buf, len, &req, &i) == 0){
i = decode_AS_REQ(buf, len, &req); err = as_rep(context, &req, reply);
if(i >= 0){ free_AS_REQ(&req);
err = as_rep(context, &req, reply); return err;
free_AS_REQ(&req); }else{
return err; if(decode_TGS_REQ(buf, len, &req, &i) == 0){
}
}
if (maybe_TGS_REQ(buf, len)){
i = decode_TGS_REQ(buf, len, &req);
if(i >= 0){
err = tgs_rep(context, &req, reply); err = tgs_rep(context, &req, reply);
free_TGS_REQ(&req); free_TGS_REQ(&req);
return err; return err;

69
kdc/kerberos5.c
View File

@@ -21,6 +21,7 @@ as_rep(krb5_context context,
EncTicketPart *et = calloc(1, sizeof(*et)); EncTicketPart *et = calloc(1, sizeof(*et));
EncKDCRepPart *ek = calloc(1, sizeof(*ek)); EncKDCRepPart *ek = calloc(1, sizeof(*ek));
krb5_principal client_princ; krb5_principal client_princ;
int e;
client = db_fetch(context, b->cname, b->realm); client = db_fetch(context, b->cname, b->realm);
server = db_fetch(context, b->sname, b->realm); server = db_fetch(context, b->sname, b->realm);
@@ -48,9 +49,10 @@ as_rep(krb5_context context,
foo.padata_value.length = 0; foo.padata_value.length = 0;
foo.padata_value.data = NULL; foo.padata_value.data = NULL;
len = encode_PA_DATA(buf + sizeof(buf) - 1, encode_PA_DATA(buf + sizeof(buf) - 1,
sizeof(buf), sizeof(buf),
&foo); &foo,
&len);
foo_data.length = len; foo_data.length = len;
foo_data.data = buf + sizeof(buf) - len; foo_data.data = buf + sizeof(buf) - len;
@@ -64,13 +66,14 @@ as_rep(krb5_context context,
} else { } else {
krb5_data ts_data; krb5_data ts_data;
PA_ENC_TS_ENC p; PA_ENC_TS_ENC p;
int len; size_t len;
EncryptedData enc_data; EncryptedData enc_data;
len = decode_EncryptedData(req->padata->val->padata_value.data, e = decode_EncryptedData(req->padata->val->padata_value.data,
req->padata->val->padata_value.length, req->padata->val->padata_value.length,
&enc_data); &enc_data,
if (len < 0) { &len);
if (e) {
krb5_mk_error (client_princ, krb5_mk_error (client_princ,
KRB5KRB_AP_ERR_BAD_INTEGRITY, KRB5KRB_AP_ERR_BAD_INTEGRITY,
"Couldn't decode", "Couldn't decode",
@@ -84,10 +87,11 @@ as_rep(krb5_context context,
enc_data.cipher.length, enc_data.cipher.length,
&client->keyblock, &client->keyblock,
&ts_data); &ts_data);
len = decode_PA_ENC_TS_ENC(ts_data.data, e = decode_PA_ENC_TS_ENC(ts_data.data,
ts_data.length, ts_data.length,
&p); &p,
if (len < 0) { &len);
if (e) {
krb5_mk_error (client_princ, krb5_mk_error (client_princ,
KRB5KRB_AP_ERR_BAD_INTEGRITY, KRB5KRB_AP_ERR_BAD_INTEGRITY,
"Couldn't decode", "Couldn't decode",
@@ -206,31 +210,31 @@ as_rep(krb5_context context,
{ {
unsigned char buf[1024]; /* XXX The data could be indefinite */ unsigned char buf[1024]; /* XXX The data could be indefinite */
int len; int len;
len = encode_EncTicketPart(buf + sizeof(buf) - 1, sizeof(buf), et); e = encode_EncTicketPart(buf + sizeof(buf) - 1, sizeof(buf), et, &len);
free_EncTicketPart(et); free_EncTicketPart(et);
free(et); free(et);
if(len < 0) if(e)
return ASN1_OVERFLOW; return e;
rep.ticket.enc_part.etype = ETYPE_DES_CBC_CRC; rep.ticket.enc_part.etype = ETYPE_DES_CBC_CRC;
rep.ticket.enc_part.kvno = NULL; rep.ticket.enc_part.kvno = NULL;
krb5_encrypt(context, buf + sizeof(buf) - len, len, &server->keyblock, krb5_encrypt(context, buf + sizeof(buf) - len, len, &server->keyblock,
&rep.ticket.enc_part.cipher); &rep.ticket.enc_part.cipher);
len = encode_EncASRepPart(buf + sizeof(buf) - 1, sizeof(buf), ek); e = encode_EncASRepPart(buf + sizeof(buf) - 1, sizeof(buf), ek, &len);
free_EncKDCRepPart(ek); free_EncKDCRepPart(ek);
free(ek); free(ek);
if(len < 0) if(e)
return ASN1_OVERFLOW; return e;
rep.enc_part.etype = ETYPE_DES_CBC_CRC; rep.enc_part.etype = ETYPE_DES_CBC_CRC;
rep.enc_part.kvno = NULL; rep.enc_part.kvno = NULL;
krb5_encrypt(context, buf + sizeof(buf) - len, len, &client->keyblock, krb5_encrypt(context, buf + sizeof(buf) - len, len, &client->keyblock,
&rep.enc_part.cipher); &rep.enc_part.cipher);
len = encode_AS_REP(buf + sizeof(buf) - 1, sizeof(buf), &rep); e = encode_AS_REP(buf + sizeof(buf) - 1, sizeof(buf), &rep, &len);
if(len < 0) if(e)
return ASN1_OVERFLOW; return e;
free_AS_REP(&rep); free_AS_REP(&rep);
krb5_data_copy(data, buf + sizeof(buf) - len, len); krb5_data_copy(data, buf + sizeof(buf) - len, len);
@@ -453,18 +457,21 @@ tgs_rep(krb5_context context,
{ {
unsigned char buf[1024]; /* XXX The data could be indefinite */ unsigned char buf[1024]; /* XXX The data could be indefinite */
int len; size_t len;
len = encode_EncTicketPart(buf + sizeof(buf) - 1, sizeof(buf), et); int e;
if(len < 0) e = encode_EncTicketPart(buf + sizeof(buf) - 1,
return ASN1_OVERFLOW; sizeof(buf), et, &len);
if(e)
return e;
rep.ticket.enc_part.etype = ETYPE_DES_CBC_CRC; rep.ticket.enc_part.etype = ETYPE_DES_CBC_CRC;
rep.ticket.enc_part.kvno = NULL; rep.ticket.enc_part.kvno = NULL;
krb5_encrypt(context, buf + sizeof(buf) - len, len, &server->keyblock, krb5_encrypt(context, buf + sizeof(buf) - len, len, &server->keyblock,
&rep.ticket.enc_part.cipher); &rep.ticket.enc_part.cipher);
len = encode_EncTGSRepPart(buf + sizeof(buf) - 1, sizeof(buf), ek); e = encode_EncTGSRepPart(buf + sizeof(buf) - 1,
if(len < 0) sizeof(buf), ek, &len);
return ASN1_OVERFLOW; if(e)
return e;
rep.enc_part.etype = ETYPE_DES_CBC_CRC; rep.enc_part.etype = ETYPE_DES_CBC_CRC;
rep.enc_part.kvno = NULL; rep.enc_part.kvno = NULL;
{ {
@@ -475,9 +482,9 @@ tgs_rep(krb5_context context,
&rep.enc_part.cipher); &rep.enc_part.cipher);
} }
len = encode_TGS_REP(buf + sizeof(buf) - 1, sizeof(buf), &rep); e = encode_TGS_REP(buf + sizeof(buf) - 1, sizeof(buf), &rep, &len);
if(len < 0) if(e)
return ASN1_OVERFLOW; return e;
free_TGS_REP(&rep); free_TGS_REP(&rep);
krb5_data_copy(data, buf + sizeof(buf) - len, len); krb5_data_copy(data, buf + sizeof(buf) - len, len);
} }

5
lib/krb5/build_ap_req.c
View File

@@ -11,6 +11,7 @@ krb5_build_ap_req (krb5_context context,
{ {
AP_REQ ap; AP_REQ ap;
Ticket t; Ticket t;
size_t len;
ap.pvno = 5; ap.pvno = 5;
ap.msg_type = krb_ap_req; ap.msg_type = krb_ap_req;
@@ -30,7 +31,7 @@ krb5_build_ap_req (krb5_context context,
krb5_principal2principalname(&ap.ticket.sname, cred->server); krb5_principal2principalname(&ap.ticket.sname, cred->server);
#endif #endif
decode_Ticket(cred->ticket.data, cred->ticket.length, &t); decode_Ticket(cred->ticket.data, cred->ticket.length, &t, &len);
copy_EncryptedData(&t.enc_part, &ap.ticket.enc_part); copy_EncryptedData(&t.enc_part, &ap.ticket.enc_part);
free_Ticket(&t); free_Ticket(&t);
@@ -40,7 +41,7 @@ krb5_build_ap_req (krb5_context context,
ret->length = length_AP_REQ(&ap); ret->length = length_AP_REQ(&ap);
ret->data = malloc(ret->length); ret->data = malloc(ret->length);
encode_AP_REQ((char *)ret->data + ret->length - 1, ret->length, &ap); encode_AP_REQ((char *)ret->data + ret->length - 1, ret->length, &ap, &len);
free_AP_REQ(&ap); free_AP_REQ(&ap);
return 0; return 0;

2
lib/krb5/build_auth.c
View File

@@ -51,7 +51,7 @@ krb5_build_authenticator (krb5_context context,
} }
memset (buf, 0, sizeof(buf)); memset (buf, 0, sizeof(buf));
len = encode_Authenticator (buf + sizeof(buf) - 1, sizeof(buf), auth); ret = encode_Authenticator (buf + sizeof(buf) - 1, sizeof(buf), auth, &len);
ret = krb5_encrypt (context, buf + sizeof(buf) - len, len, &cred->session, ret = krb5_encrypt (context, buf + sizeof(buf) - len, len, &cred->session,
result); result);

75
lib/krb5/get_cred.c
View File

@@ -27,7 +27,7 @@ krb5_get_credentials (krb5_context context,
krb5_creds *in_creds, krb5_creds *in_creds,
krb5_creds **out_creds) krb5_creds **out_creds)
{ {
krb5_error_code err; krb5_error_code ret;
TGS_REQ a; TGS_REQ a;
Authenticator auth; Authenticator auth;
krb5_data authenticator; krb5_data authenticator;
@@ -50,12 +50,12 @@ krb5_get_credentials (krb5_context context,
*out_creds = malloc(sizeof(**out_creds)); *out_creds = malloc(sizeof(**out_creds));
memset(*out_creds, 0, sizeof(**out_creds)); memset(*out_creds, 0, sizeof(**out_creds));
err = krb5_cc_retrieve_cred(context, ccache, 0, in_creds, *out_creds); ret = krb5_cc_retrieve_cred(context, ccache, 0, in_creds, *out_creds);
if (err == 0) if (ret == 0)
return err; return ret;
else if (err != KRB5_CC_END) { else if (ret != KRB5_CC_END) {
free(*out_creds); free(*out_creds);
return err; return ret;
} }
/* /*
@@ -64,18 +64,18 @@ krb5_get_credentials (krb5_context context,
memset(&a, 0, sizeof(a)); memset(&a, 0, sizeof(a));
err = krb5_get_default_in_tkt_etypes (context, ret = krb5_get_default_in_tkt_etypes (context,
(krb5_enctype**)&a.req_body.etype.val); (krb5_enctype**)&a.req_body.etype.val);
if (err) if (ret)
return err; return ret;
a.req_body.etype.len = 1; a.req_body.etype.len = 1;
a.req_body.addresses = malloc(sizeof(*a.req_body.addresses)); a.req_body.addresses = malloc(sizeof(*a.req_body.addresses));
err = krb5_get_all_client_addrs ((krb5_addresses*)a.req_body.addresses); ret = krb5_get_all_client_addrs ((krb5_addresses*)a.req_body.addresses);
if (err) if (ret)
return err; return ret;
a.pvno = 5; a.pvno = 5;
a.msg_type = krb_tgs_req; a.msg_type = krb_tgs_req;
@@ -111,38 +111,38 @@ krb5_get_credentials (krb5_context context,
int len; int len;
krb5_creds tmp_cred; krb5_creds tmp_cred;
len = encode_KDC_REQ_BODY(buf + sizeof(buf) - 1, sizeof(buf), ret = encode_KDC_REQ_BODY(buf + sizeof(buf) - 1, sizeof(buf),
&a.req_body); &a.req_body, &len);
in_data.length = len; in_data.length = len;
in_data.data = buf + sizeof(buf) - len; in_data.data = buf + sizeof(buf) - len;
tmp_cred.client = NULL; tmp_cred.client = NULL;
err = krb5_build_principal(context, ret = krb5_build_principal(context,
&tmp_cred.server, &tmp_cred.server,
strlen(a.req_body.realm), strlen(a.req_body.realm),
a.req_body.realm, a.req_body.realm,
"krbtgt", "krbtgt",
a.req_body.realm, a.req_body.realm,
NULL); NULL);
if (err) if (ret)
return err; return ret;
err = krb5_get_credentials (context, ret = krb5_get_credentials (context,
0, 0,
ccache, ccache,
&tmp_cred, &tmp_cred,
out_creds); out_creds);
if (err) if (ret)
return err; return ret;
err = krb5_mk_req_extended(context, ret = krb5_mk_req_extended(context,
&ac, &ac,
0, 0,
&in_data, &in_data,
*out_creds, *out_creds,
&foo.padata_value); &foo.padata_value);
if(err) if(ret)
return err; return ret;
foo.padata_type = pa_tgs_req; foo.padata_type = pa_tgs_req;
} }
@@ -155,8 +155,8 @@ krb5_get_credentials (krb5_context context,
* Encode * Encode
*/ */
req.length = encode_TGS_REQ (buf + sizeof (buf) - 1, sizeof(buf), &a); encode_TGS_REQ (buf + sizeof (buf) - 1, sizeof(buf), &a, &req.length);
req.data = buf + sizeof(buf) - req.length; req.data = buf + sizeof(buf) - req.length;
for (i = 0; i < a.req_body.addresses->len; ++i) for (i = 0; i < a.req_body.addresses->len; ++i)
krb5_data_free (&a.req_body.addresses->val[i].address); krb5_data_free (&a.req_body.addresses->val[i].address);
@@ -168,21 +168,21 @@ krb5_get_credentials (krb5_context context,
{ {
TGS_REQ xx; TGS_REQ xx;
decode_TGS_REQ (req.data, req.length, &xx); size_t size;
decode_TGS_REQ (req.data, req.length, &xx, &size);
req.length = req.length; req.length = req.length;
} }
err = krb5_sendto_kdc (context, &req, &in_creds->server->realm, &resp); ret = krb5_sendto_kdc (context, &req, &in_creds->server->realm, &resp);
if (err) { if (ret) {
return err; return ret;
} }
switch(((unsigned char*)resp.data)[0] & 0x1f){ switch(((unsigned char*)resp.data)[0] & 0x1f){
case krb_error:{ case krb_error:{
krb5_principal princ; krb5_principal princ;
char *name; char *name;
len = decode_KRB_ERROR(resp.data, resp.length, &error); ret = decode_KRB_ERROR(resp.data, resp.length, &error, &len);
if(len < 0) if(ret) return ret;
return ASN1_PARSE_ERROR;
principalname2krb5_principal(&princ, error.sname, error.realm); principalname2krb5_principal(&princ, error.sname, error.realm);
krb5_unparse_name(context, princ, &name); krb5_unparse_name(context, princ, &name);
fprintf(stderr, "Error: %s", name); fprintf(stderr, "Error: %s", name);
@@ -193,16 +193,15 @@ krb5_get_credentials (krb5_context context,
break; break;
} }
case krb_tgs_rep: case krb_tgs_rep:
len = decode_TGS_REP(resp.data, resp.length, &rep.part1); ret = decode_TGS_REP(resp.data, resp.length, &rep.part1, &len);
if(len < 0) if(ret) return ret;
return ASN1_PARSE_ERROR; ret = extract_ticket(context, &rep, *out_creds,
err = extract_ticket(context, &rep, *out_creds,
&(*out_creds)->session, &(*out_creds)->session,
NULL, NULL,
NULL, NULL,
NULL); NULL);
if(err) if(ret)
return err; return ret;
return krb5_cc_store_cred (context, ccache, *out_creds); return krb5_cc_store_cred (context, ccache, *out_creds);
break; break;
} }

116
lib/krb5/get_in_tkt.c
View File

@@ -10,6 +10,7 @@ decrypt_tkt (krb5_context context,
{ {
krb5_error_code ret; krb5_error_code ret;
krb5_data data; krb5_data data;
size_t size;
ret = krb5_decrypt (context, ret = krb5_decrypt (context,
dec_rep->part1.enc_part.cipher.data, dec_rep->part1.enc_part.cipher.data,
@@ -17,18 +18,19 @@ decrypt_tkt (krb5_context context,
key, key,
&data); &data);
if (ret) if (ret)
return ret; return ret;
ret = decode_EncASRepPart(data.data, ret = decode_EncASRepPart(data.data,
data.length, data.length,
&dec_rep->part2); &dec_rep->part2,
if (ret < 0) &size);
ret = decode_EncTGSRepPart(data.data, if (ret)
data.length, ret = decode_EncTGSRepPart(data.data,
&dec_rep->part2); data.length,
&dec_rep->part2,
&size);
krb5_data_free (&data); krb5_data_free (&data);
if (ret < 0) if (ret) return ret;
return ASN1_PARSE_ERROR;
return 0; return 0;
} }
@@ -51,8 +53,8 @@ extract_ticket(krb5_context context,
{ {
char buf[1024]; char buf[1024];
int len; int len;
len = encode_Ticket(buf + sizeof(buf) - 1, sizeof(buf), encode_Ticket(buf + sizeof(buf) - 1, sizeof(buf),
&rep->part1.ticket); &rep->part1.ticket, &len);
creds->ticket.data = malloc(len); creds->ticket.data = malloc(len);
memcpy(creds->ticket.data, buf + sizeof(buf) - len, len); memcpy(creds->ticket.data, buf + sizeof(buf) - len, len);
creds->ticket.length = len; creds->ticket.length = len;
@@ -144,7 +146,7 @@ krb5_get_in_tkt(krb5_context context,
krb5_ccache ccache, krb5_ccache ccache,
krb5_kdc_rep **ret_as_reply) krb5_kdc_rep **ret_as_reply)
{ {
krb5_error_code err; krb5_error_code ret;
AS_REQ a; AS_REQ a;
krb5_kdc_rep rep; krb5_kdc_rep rep;
krb5_data req, resp; krb5_data req, resp;
@@ -152,6 +154,7 @@ krb5_get_in_tkt(krb5_context context,
char buf[BUFSIZ]; char buf[BUFSIZ];
krb5_data salt; krb5_data salt;
krb5_keyblock *key; krb5_keyblock *key;
size_t size;
memset(&a, 0, sizeof(a)); memset(&a, 0, sizeof(a));
@@ -175,10 +178,10 @@ krb5_get_in_tkt(krb5_context context,
if (etypes) if (etypes)
abort (); abort ();
else { else {
err = krb5_get_default_in_tkt_etypes (context, ret = krb5_get_default_in_tkt_etypes (context,
(krb5_enctype**)&a.req_body.etype.val); (krb5_enctype**)&a.req_body.etype.val);
if (err) if (ret)
return err; return ret;
a.req_body.etype.len = 1; a.req_body.etype.len = 1;
} }
if (addrs){ if (addrs){
@@ -186,9 +189,9 @@ krb5_get_in_tkt(krb5_context context,
} else { } else {
a.req_body.addresses = malloc(sizeof(*a.req_body.addresses)); a.req_body.addresses = malloc(sizeof(*a.req_body.addresses));
err = krb5_get_all_client_addrs ((krb5_addresses*)a.req_body.addresses); ret = krb5_get_all_client_addrs ((krb5_addresses*)a.req_body.addresses);
if (err) if (ret)
return err; return ret;
} }
a.req_body.enc_authorization_data = NULL; a.req_body.enc_authorization_data = NULL;
a.req_body.additional_tickets = NULL; a.req_body.additional_tickets = NULL;
@@ -202,16 +205,16 @@ krb5_get_in_tkt(krb5_context context,
salt.length = 0; salt.length = 0;
salt.data = NULL; salt.data = NULL;
err = krb5_get_salt (creds->client, &salt); ret = krb5_get_salt (creds->client, &salt);
if (err) if (ret)
return err; return ret;
err = (*key_proc)(context, *(a.req_body.etype.val), &salt, ret = (*key_proc)(context, *(a.req_body.etype.val), &salt,
keyseed, &key); keyseed, &key);
krb5_data_free (&salt); krb5_data_free (&salt);
if (err) if (ret)
return err; return ret;
/* not sure this is the way to use `ptypes' */ /* not sure this is the way to use `ptypes' */
if (ptypes == NULL || *ptypes == KRB5_PADATA_NONE) if (ptypes == NULL || *ptypes == KRB5_PADATA_NONE)
@@ -220,7 +223,7 @@ krb5_get_in_tkt(krb5_context context,
PA_ENC_TS_ENC p; PA_ENC_TS_ENC p;
u_char buf[1024]; u_char buf[1024];
struct timeval tv; struct timeval tv;
int len; size_t len;
unsigned foo; unsigned foo;
EncryptedData encdata; EncryptedData encdata;
@@ -229,11 +232,12 @@ krb5_get_in_tkt(krb5_context context,
foo = tv.tv_usec; foo = tv.tv_usec;
p.pausec = &foo; p.pausec = &foo;
len = encode_PA_ENC_TS_ENC(buf + sizeof(buf) - 1, ret = encode_PA_ENC_TS_ENC(buf + sizeof(buf) - 1,
sizeof(buf), sizeof(buf),
&p); &p,
if (len < 0) &len);
return ASN1_PARSE_ERROR; if (ret)
return ret;
a.padata = malloc(sizeof(*a.padata)); a.padata = malloc(sizeof(*a.padata));
a.padata->len = 1; a.padata->len = 1;
@@ -243,59 +247,63 @@ krb5_get_in_tkt(krb5_context context,
encdata.etype = ETYPE_DES_CBC_CRC; encdata.etype = ETYPE_DES_CBC_CRC;
encdata.kvno = NULL; encdata.kvno = NULL;
err = krb5_encrypt (context, ret = krb5_encrypt (context,
buf + sizeof(buf) - len, buf + sizeof(buf) - len,
len, len,
key, key,
&encdata.cipher); &encdata.cipher);
if (err) if (ret)
return err; return ret;
len = encode_EncryptedData(buf + sizeof(buf) - 1, ret = encode_EncryptedData(buf + sizeof(buf) - 1,
sizeof(buf), sizeof(buf),
&encdata); &encdata,
&len);
krb5_data_free(&encdata.cipher); krb5_data_free(&encdata.cipher);
if (len < 0) if (ret)
return ASN1_PARSE_ERROR; return ret;
krb5_data_copy(&a.padata->val->padata_value, krb5_data_copy(&a.padata->val->padata_value,
buf + sizeof(buf) - len, buf + sizeof(buf) - len,
len); len);
} else } else
return KRB5_PREAUTH_BAD_TYPE; return KRB5_PREAUTH_BAD_TYPE;
req.length = encode_AS_REQ ((unsigned char*)buf + sizeof(buf) - 1, ret = encode_AS_REQ ((unsigned char*)buf + sizeof(buf) - 1,
sizeof(buf), sizeof(buf),
&a); &a,
if (req.length < 0){ &req.length);
if (ret){
free_AS_REQ(&a); free_AS_REQ(&a);
return ASN1_PARSE_ERROR; return ret;
} }
free_AS_REQ(&a); free_AS_REQ(&a);
req.data = buf + sizeof(buf) - req.length; req.data = buf + sizeof(buf) - req.length;
err = krb5_sendto_kdc (context, &req, &creds->client->realm, &resp); ret = krb5_sendto_kdc (context, &req, &creds->client->realm, &resp);
if (err) { if (ret) {
return err; return ret;
} }
if(decode_AS_REP(resp.data, resp.length, &rep.part1) < 0){ if((ret = decode_AS_REP(resp.data, resp.length, &rep.part1, &size))){
/* let's try to parse it as a KRB-ERROR */ /* let's try to parse it as a KRB-ERROR */
KRB_ERROR error; KRB_ERROR error;
int ret2;
if (decode_KRB_ERROR(resp.data, resp.length, &error) >= 0) { ret2 = decode_KRB_ERROR(resp.data, resp.length, &error, &size);
/* XXX */
fprintf (stderr, "get_in_tkt: KRB_ERROR: %s\n",
*(error.e_text));
}
krb5_data_free(&resp); krb5_data_free(&resp);
return ASN1_PARSE_ERROR; if (ret2 == 0) {
/* XXX */
fprintf (stderr, "get_in_tkt: KRB_ERROR: %s\n", *(error.e_text));
return error.error_code;
}
return ret;
} }
krb5_data_free(&resp); krb5_data_free(&resp);
err = extract_ticket(context, &rep, creds, key, keyseed, ret = extract_ticket(context, &rep, creds, key, keyseed,
decrypt_proc, decryptarg); decrypt_proc, decryptarg);
free_KDC_REP(&rep.part1); free_KDC_REP(&rep.part1);
if(err) if(ret)
return err; return ret;
return krb5_cc_store_cred (context, ccache, creds); return krb5_cc_store_cred (context, ccache, creds);
} }

2
lib/krb5/mk_error.c
View File

@@ -27,7 +27,7 @@ krb5_mk_error(krb5_principal princ,
msg.e_text = &e_text; msg.e_text = &e_text;
if (e_data) if (e_data)
msg.e_data = e_data; msg.e_data = e_data;
err->length = encode_KRB_ERROR(buf + sizeof(buf) - 1, sizeof(buf), &msg); encode_KRB_ERROR(buf + sizeof(buf) - 1, sizeof(buf), &msg, &err->length);
err->data = malloc(err->length); err->data = malloc(err->length);
memcpy(err->data, buf + sizeof(buf) - err->length, err->length); memcpy(err->data, buf + sizeof(buf) - err->length, err->length);
return 0; return 0;

12
lib/krb5/mk_priv.c
View File

@@ -36,10 +36,10 @@ krb5_mk_priv(krb5_context context,
part.s_address.address = addr.addrs[0].address; part.s_address.address = addr.addrs[0].address;
part.r_address = NULL; part.r_address = NULL;
len = encode_EncKrbPrivPart (buf + sizeof(buf) - 1, sizeof(buf), &part); r = encode_EncKrbPrivPart (buf + sizeof(buf) - 1, sizeof(buf), &part, &len);
free (part.seq_number); free (part.seq_number);
if (len < 0) if (r)
return ASN1_PARSE_ERROR; return r;
s.pvno = 5; s.pvno = 5;
s.msg_type = krb_priv; s.msg_type = krb_priv;
@@ -51,9 +51,9 @@ krb5_mk_priv(krb5_context context,
if (r) if (r)
return r; return r;
len = encode_KRB_PRIV (buf + sizeof(buf) - 1, sizeof(buf), &s); r = encode_KRB_PRIV (buf + sizeof(buf) - 1, sizeof(buf), &s, &len);
if (len < 0) if (r)
return ASN1_PARSE_ERROR; return r;
outbuf->length = len; outbuf->length = len;
outbuf->data = malloc (len); outbuf->data = malloc (len);
if (outbuf->data == NULL) if (outbuf->data == NULL)

6
lib/krb5/mk_rep.c
View File

@@ -32,15 +32,13 @@ krb5_mk_rep(krb5_context context,
ap.enc_part.etype = (*auth_context)->key.keytype; ap.enc_part.etype = (*auth_context)->key.keytype;
ap.enc_part.kvno = NULL; ap.enc_part.kvno = NULL;
len = encode_EncAPRepPart (buf + sizeof(buf) - 1, encode_EncAPRepPart (buf + sizeof(buf) - 1, sizeof(buf), &body, &len);
sizeof(buf), &body);
ret = krb5_encrypt (context, buf + sizeof(buf) - len, len, ret = krb5_encrypt (context, buf + sizeof(buf) - len, len,
&(*auth_context)->key, &ap.enc_part.cipher); &(*auth_context)->key, &ap.enc_part.cipher);
if (ret) if (ret)
return ret; return ret;
len = encode_AP_REP (buf + sizeof(buf) - 1, encode_AP_REP (buf + sizeof(buf) - 1, sizeof(buf), &ap, &len);
sizeof(buf), &ap);
free (ap.enc_part.cipher.data); free (ap.enc_part.cipher.data);
outbuf->length = len; outbuf->length = len;
outbuf->data = malloc(len); outbuf->data = malloc(len);

6
lib/krb5/mk_safe.c
View File

@@ -45,10 +45,10 @@ krb5_mk_safe(krb5_context context,
s.safe_body.s_address = addr.addrs[0]; s.safe_body.s_address = addr.addrs[0];
s.safe_body.r_address = NULL; s.safe_body.r_address = NULL;
len = encode_KRB_SAFE (buf + sizeof(buf) - 1, sizeof(buf), &s); r = encode_KRB_SAFE (buf + sizeof(buf) - 1, sizeof(buf), &s, &len);
free(s.safe_body.seq_number); free(s.safe_body.seq_number);
if (len < 0) if (r)
return ASN1_PARSE_ERROR; return r;
outbuf->length = len; outbuf->length = len;
outbuf->data = malloc (len); outbuf->data = malloc (len);
if (outbuf->data == NULL) if (outbuf->data == NULL)

24
lib/krb5/rd_priv.c
View File

@@ -12,29 +12,29 @@ krb5_rd_priv(krb5_context context,
krb5_error_code r; krb5_error_code r;
KRB_PRIV priv; KRB_PRIV priv;
EncKrbPrivPart part; EncKrbPrivPart part;
int len; size_t len;
krb5_data plain; krb5_data plain;
len = decode_KRB_PRIV (inbuf->data, inbuf->length, &priv); r = decode_KRB_PRIV (inbuf->data, inbuf->length, &priv, &len);
if (len < 0) if (r)
return ASN1_PARSE_ERROR; return r;
if (priv.pvno != 5) if (priv.pvno != 5)
return KRB5KRB_AP_ERR_BADVERSION; return KRB5KRB_AP_ERR_BADVERSION;
if (priv.msg_type != krb_safe) if (priv.msg_type != krb_safe)
return KRB5KRB_AP_ERR_MSG_TYPE; return KRB5KRB_AP_ERR_MSG_TYPE;
r = krb5_decrypt (context, r = krb5_decrypt (context,
priv.enc_part.cipher.data, priv.enc_part.cipher.data,
priv.enc_part.cipher.length, priv.enc_part.cipher.length,
&auth_context->key, &auth_context->key,
&plain); &plain);
if (r) if (r)
return r; return r;
len = decode_EncKrbPrivPart (plain.data, plain.length, &part);
if (len < 0)
return ASN1_PARSE_ERROR;
r = decode_EncKrbPrivPart (plain.data, plain.length, &part, &len);
if (r)
return r;
/* check timestamp */ /* check timestamp */
if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) { if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_TIME) {
struct timeval tv; struct timeval tv;

17
lib/krb5/rd_rep.c
View File

@@ -16,9 +16,9 @@ krb5_rd_rep(krb5_context context,
int i; int i;
krb5_data data; krb5_data data;
len = decode_AP_REP(inbuf->data, inbuf->length, &ap_rep); ret = decode_AP_REP(inbuf->data, inbuf->length, &ap_rep, &len);
if (len < 0) if (ret)
return ASN1_PARSE_ERROR; return ret;
if (ap_rep.pvno != 5) if (ap_rep.pvno != 5)
return KRB5KRB_AP_ERR_BADVERSION; return KRB5KRB_AP_ERR_BADVERSION;
if (ap_rep.msg_type != krb_ap_rep) if (ap_rep.msg_type != krb_ap_rep)
@@ -35,11 +35,12 @@ krb5_rd_rep(krb5_context context,
*repl = malloc(sizeof(**repl)); *repl = malloc(sizeof(**repl));
if (*repl == NULL) if (*repl == NULL)
return ENOMEM; return ENOMEM;
i = decode_EncAPRepPart(data.data, ret = decode_EncAPRepPart(data.data,
data.length, data.length,
*repl); *repl,
if (i < 0) &i);
return ASN1_PARSE_ERROR; if (ret)
return ret;
if ((*repl)->ctime != auth_context->authenticator->ctime || if ((*repl)->ctime != auth_context->authenticator->ctime ||
(*repl)->cusec != auth_context->authenticator->cusec) { (*repl)->cusec != auth_context->authenticator->cusec) {
printf("KRB5KRB_AP_ERR_MUT_FAIL\n"); printf("KRB5KRB_AP_ERR_MUT_FAIL\n");

20
lib/krb5/rd_req.c
View File

@@ -16,10 +16,10 @@ decrypt_tkt_enc_part (krb5_context context,
if (ret) if (ret)
return ret; return ret;
len = decode_EncTicketPart(plain.data, plain.length, decr_part); ret = decode_EncTicketPart(plain.data, plain.length, decr_part, &len);
krb5_data_free (&plain); krb5_data_free (&plain);
if (len < 0) if (ret)
return ASN1_PARSE_ERROR; return ret;
return 0; return 0;
} }
@@ -31,16 +31,16 @@ decrypt_authenticator (krb5_context context,
{ {
krb5_error_code ret; krb5_error_code ret;
krb5_data plain; krb5_data plain;
int len; size_t len;
ret = krb5_decrypt (context, enc_part->cipher.data, enc_part->cipher.length, key, &plain); ret = krb5_decrypt (context, enc_part->cipher.data, enc_part->cipher.length, key, &plain);
if (ret) if (ret)
return ret; return ret;
len = decode_Authenticator(plain.data, plain.length, authenticator); ret = decode_Authenticator(plain.data, plain.length, authenticator, &len);
krb5_data_free (&plain); krb5_data_free (&plain);
if (len < 0) if (ret)
return ASN1_PARSE_ERROR; return ret;
return 0; return 0;
} }
@@ -64,9 +64,9 @@ krb5_rd_req_with_keyblock(krb5_context context,
return ret; return ret;
} }
len = decode_AP_REQ(inbuf->data, inbuf->length, &ap_req); ret = decode_AP_REQ(inbuf->data, inbuf->length, &ap_req, &len);
if (len < 0) if (ret)
return ASN1_PARSE_ERROR; return ret;
if (ap_req.pvno != 5) if (ap_req.pvno != 5)
return KRB5KRB_AP_ERR_BADVERSION; return KRB5KRB_AP_ERR_BADVERSION;
if (ap_req.msg_type != krb_ap_req) if (ap_req.msg_type != krb_ap_req)

8
lib/krb5/rd_safe.c
View File

@@ -11,11 +11,11 @@ krb5_rd_safe(krb5_context context,
{ {
krb5_error_code r; krb5_error_code r;
KRB_SAFE safe; KRB_SAFE safe;
int len; size_t len;
len = decode_KRB_SAFE (inbuf->data, inbuf->length, &safe); r = decode_KRB_SAFE (inbuf->data, inbuf->length, &safe, &len);
if (len < 0) if (r)
return ASN1_PARSE_ERROR; return r;
if (safe.pvno != 5) if (safe.pvno != 5)
return KRB5KRB_AP_ERR_BADVERSION; return KRB5KRB_AP_ERR_BADVERSION;
if (safe.msg_type != krb_safe) if (safe.msg_type != krb_safe)