oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

krb5: krb5_get_init_creds_opt_set_pkinit flag names

Browse Source 
Add macros to give symbolic names to the flags which can be passed to
krb5_get_init_creds_opt_set_pkinit(). Reserve flags for BTMM and not validating
KDC anchors.
This commit is contained in:
Luke Howard
2019-05-06 11:29:04 +10:00
committed by Jeffrey Altman
parent bcc90f1b87
commit 5ca229e0d9
3 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
kuser/kinit.c
View File

@@ -537,8 +537,8 @@ get_new_tickets(krb5_context context,
pk_x509_anchors, pk_x509_anchors,
NULL, NULL,
NULL, NULL,
pk_use_enckey ? 2 : 0 | pk_use_enckey ? KRB5_GIC_OPT_PKINIT_USE_ENCKEY : 0 |
anonymous_pkinit ? 4 : 0, anonymous_pkinit ? KRB5_GIC_OPT_PKINIT_ANONYMOUS : 0,
prompter, prompter,
NULL, NULL,
passwd); passwd);

9
lib/krb5/krb5.h
View File

@@ -944,6 +944,15 @@ typedef struct krb5_name_canon_rule_data *krb5_name_canon_rule;
typedef const struct krb5_name_canon_rule_data *krb5_const_name_canon_rule; typedef const struct krb5_name_canon_rule_data *krb5_const_name_canon_rule;
typedef struct krb5_name_canon_iterator_data *krb5_name_canon_iterator; typedef struct krb5_name_canon_iterator_data *krb5_name_canon_iterator;
/*
* krb5_get_init_creds_opt_set_pkinit flags
*/
#define KRB5_GIC_OPT_PKINIT_USE_ENCKEY 2 /* use RSA, not DH */
#define KRB5_GIC_OPT_PKINIT_ANONYMOUS 4 /* anonymous PKINIT */
#define KRB5_GIC_OPT_PKINIT_BTMM 8 /* reserved by Apple */
#define KRB5_GIC_OPT_PKINIT_NO_KDC_ANCHOR 16 /* do not authenticate KDC */
/* /*
* *
*/ */

4
lib/krb5/pkinit.c
View File

@@ -2269,7 +2269,7 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
x509_anchors = anchors; x509_anchors = anchors;
} }
if (flags & 4) if (flags & KRB5_GIC_OPT_PKINIT_ANONYMOUS)
opt->opt_private->pk_init_ctx->anonymous = 1; opt->opt_private->pk_init_ctx->anonymous = 1;
ret = _krb5_pk_load_id(context, ret = _krb5_pk_load_id(context,
@@ -2295,7 +2295,7 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
} else } else
opt->opt_private->pk_init_ctx->id->cert = NULL; opt->opt_private->pk_init_ctx->id->cert = NULL;
if ((flags & 2) == 0) { if ((flags & KRB5_GIC_OPT_PKINIT_USE_ENCKEY) == 0) {
hx509_context hx509ctx = context->hx509ctx; hx509_context hx509ctx = context->hx509ctx;
hx509_cert cert = opt->opt_private->pk_init_ctx->id->cert; hx509_cert cert = opt->opt_private->pk_init_ctx->id->cert;