oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Since the decode can't make out the diffrence between PA-PK-AS-REP-19

Browse Source 
and PA-PK-AS-REQ-Win2k, try harder to verify both cases


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@14722 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2005-04-04 08:54:45 +00:00
parent e0d75a3766
commit 6611feed76
1 changed files with 64 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

151
lib/krb5/pkinit.c
View File

@@ -717,8 +717,10 @@ pk_mk_padata(krb5_context context,
memset(&req_19, 0, sizeof(req_19));
ret = copy_ContentInfo(&content_info, &req_19.signedAuthPack);
if (ret)
if (ret) {
krb5_clear_error_string(context);
goto out;
}
req_19.kdcCert = NULL;
req_19.trustedCertifiers = NULL;
req_19.encryptionCert = NULL;
@@ -780,15 +782,16 @@ _krb5_pk_mk_padata(krb5_context context,
ret = pk_mk_padata(context, COMPAT_WIN2K, ctx, req_body, nonce, md);
if (ret)
goto out;
}
ret = pk_mk_padata(context, COMPAT_19, ctx, req_body, nonce, md);
if (ret)
goto out;
} else {
ret = pk_mk_padata(context, COMPAT_19, ctx, req_body, nonce, md);
if (ret)
goto out;
#if 0
ret = pk_mk_padata(context, COMPAT_25, ctx, req_body, nonce, md);
if (ret)
goto out;
ret = pk_mk_padata(context, COMPAT_25, ctx, req_body, nonce, md);
if (ret)
goto out;
#endif
}
provisioning_server =
krb5_config_get_string(context, NULL,
@@ -1630,55 +1633,6 @@ pk_rd_pa_reply_dh(krb5_context context,
return ret;
}
static krb5_error_code
_krb5_pk_convert_rep(krb5_context context,
PA_PK_AS_REP_Win2k *r_win2k,
PA_PK_AS_REP_19 *r)
{
krb5_error_code ret;
ContentInfo ci;
size_t size;
switch (r_win2k->element) {
case choice_PA_PK_AS_REP_Win2k_dhSignedData:
r->element = choice_PA_PK_AS_REP_19_dhSignedData;
ret = decode_ContentInfo(r_win2k->u.dhSignedData.data,
r_win2k->u.dhSignedData.length,
&ci,
&size);
if (ret) {
krb5_set_error_string(context,
"PKINIT: decoding failed ContentInfo: %d",
ret);
return ret;
}
r->u.dhSignedData = ci;
break;
case choice_PA_PK_AS_REP_Win2k_encKeyPack:
r->element = choice_PA_PK_AS_REP_19_encKeyPack;
ret = decode_ContentInfo(r_win2k->u.encKeyPack.data,
r_win2k->u.encKeyPack.length,
&ci,
&size);
if (ret) {
krb5_set_error_string(context,
"PKINIT: decoding failed ContentInfo: %d",
ret);
return ret;
}
r->u.encKeyPack = ci;
break;
default:
krb5_set_error_string(context, "PKINIT: reply invalid content type");
return EINVAL;
}
return ret;
}
krb5_error_code KRB5_LIB_FUNCTION
_krb5_pk_rd_pa_reply(krb5_context context,
void *c,
@@ -1690,8 +1644,9 @@ _krb5_pk_rd_pa_reply(krb5_context context,
krb5_pk_init_ctx ctx = c;
krb5_error_code ret;
PA_PK_AS_REP_19 rep;
PA_PK_AS_REP_Win2k w2krep;
ContentInfo ci;
size_t size;
int win2k_compat = 0;
memset(&rep, 0, sizeof(rep));
@@ -1699,46 +1654,68 @@ _krb5_pk_rd_pa_reply(krb5_context context,
pa->padata_value.length,
&rep,
&size);
if (ret != 0) {
PA_PK_AS_REP_Win2k w2krep;
free_PA_PK_AS_REP_19(&rep);
memset(&rep, 0, sizeof(rep));
ret = decode_PA_PK_AS_REP_Win2k(pa->padata_value.data,
pa->padata_value.length,
&w2krep,
&size);
if (ret) {
krb5_set_error_string(context, "PKINIT: Failed decoding windows"
"pkinit reply %d", ret);
return ret;
if (ret == 0) {
switch(rep.element) {
case choice_PA_PK_AS_REP_19_dhSignedData:
ret = pk_rd_pa_reply_dh(context, &rep.u.dhSignedData, ctx,
etype, nonce, pa, key);
break;
case choice_PA_PK_AS_REP_19_encKeyPack:
ret = pk_rd_pa_reply_enckey(context, 0,
&rep.u.encKeyPack, ctx,
etype, nonce, pa, key);
break;
default:
krb5_set_error_string(context, "PKINIT: reply invalid "
"content type");
ret = EINVAL;
break;
}
ret = _krb5_pk_convert_rep(context, &w2krep, &rep);
free_PA_PK_AS_REP_Win2k(&w2krep);
if (ret)
return ret;
free_PA_PK_AS_REP_19(&rep);
win2k_compat = 1;
if (ret == 0)
return 0;
}
switch(rep.element) {
case choice_PA_PK_AS_REP_19_dhSignedData:
ret = pk_rd_pa_reply_dh(context, &rep.u.dhSignedData, ctx,
etype, nonce, pa, key);
break;
case choice_PA_PK_AS_REP_19_encKeyPack:
ret = pk_rd_pa_reply_enckey(context, win2k_compat,
&rep.u.encKeyPack, ctx,
/* Check for Windows encoding of the AS-REP pa data */
memset(&w2krep, 0, sizeof(w2krep));
ret = decode_PA_PK_AS_REP_Win2k(pa->padata_value.data,
pa->padata_value.length,
&w2krep,
&size);
if (ret) {
krb5_set_error_string(context, "PKINIT: Failed decoding windows"
"pkinit reply %d", ret);
return ret;
}
switch (w2krep.element) {
case choice_PA_PK_AS_REP_Win2k_encKeyPack:
ret = decode_ContentInfo(w2krep.u.encKeyPack.data,
w2krep.u.encKeyPack.length,
&ci,
&size);
if (ret) {
krb5_set_error_string(context,
"PKINIT: decoding failed ContentInfo: %d",
ret);
return ret;
}
ret = pk_rd_pa_reply_enckey(context, 1, &ci, ctx,
etype, nonce, pa, key);
free_ContentInfo(&ci);
break;
default:
krb5_set_error_string(context, "PKINIT: reply invalid content type");
ret = EINVAL;
break;
}
free_PA_PK_AS_REP_19(&rep);
free_PA_PK_AS_REP_Win2k(&w2krep);
return ret;
}