oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Check dh group parameters from client.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@16137 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2005-10-07 08:57:51 +00:00
parent 0fa6eefd9f
commit 776512783d
1 changed files with 25 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
kdc/pkinit.c
View File

@@ -111,6 +111,7 @@ struct pk_principal_mapping {
static struct krb5_pk_identity *kdc_identity; static struct krb5_pk_identity *kdc_identity;
static struct pk_principal_mapping principal_mappings; static struct pk_principal_mapping principal_mappings;
static struct krb5_dh_moduli **moduli;
/* /*
* *
@@ -408,6 +409,12 @@ get_dh_param(krb5_context context, SubjectPublicKeyInfo *dh_key_info,
goto out; goto out;
} }
ret = _krb5_dh_group_ok(context, 0,
&dhparam.p, &dhparam.g, &dhparam.q, moduli);
if (ret)
goto out;
dh = DH_new(); dh = DH_new();
if (dh == NULL) { if (dh == NULL) {
krb5_set_error_string(context, "Cannot create DH structure (%s)", krb5_set_error_string(context, "Cannot create DH structure (%s)",
@@ -450,7 +457,7 @@ get_dh_param(krb5_context context, SubjectPublicKeyInfo *dh_key_info,
if (DH_check(dh, &dhret) != 1) { if (DH_check(dh, &dhret) != 1) {
krb5_set_error_string(context, "PKINIT DH data not ok: %s", krb5_set_error_string(context, "PKINIT DH data not ok: %s",
ERR_error_string(ERR_get_error(), NULL)); ERR_error_string(ERR_get_error(), NULL));
ret = KRB5_KDC_ERR_KEY_SIZE; ret = KRB5_KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED;
goto out; goto out;
} }
@@ -1579,7 +1586,7 @@ _kdc_pk_check_client(krb5_context context,
free(*subject_name); free(*subject_name);
*subject_name = NULL; *subject_name = NULL;
krb5_set_error_string(context, "PKINIT no matching principals"); krb5_set_error_string(context, "PKINIT no matching principals");
return KRB5_KDC_ERROR_CLIENT_NAME_MISMATCH; return KRB5_KDC_ERR_CLIENT_NAME_MISMATCH;
} }
static krb5_error_code static krb5_error_code
@@ -1620,12 +1627,19 @@ _kdc_pk_initialize(krb5_context context,
const char *user_id, const char *user_id,
const char *x509_anchors) const char *x509_anchors)
{ {
const char *mapping_file; const char *file;
krb5_error_code ret; krb5_error_code ret;
char buf[1024]; char buf[1024];
unsigned long lineno = 0; unsigned long lineno = 0;
FILE *f; FILE *f;
file = krb5_config_get_string(context, NULL,
"libdefaults", "moduli", NULL);
ret = _krb5_parse_moduli(context, NULL, &moduli);
if (ret)
krb5_err(context, 1, ret, "PKINIT: failed to load modidi file");
principal_mappings.len = 0; principal_mappings.len = 0;
principal_mappings.val = NULL; principal_mappings.val = NULL;
@@ -1642,16 +1656,15 @@ _kdc_pk_initialize(krb5_context context,
return ret; return ret;
} }
mapping_file = krb5_config_get_string_default(context, file = krb5_config_get_string_default(context,
NULL, NULL,
HDB_DB_DIR "/pki-mapping", HDB_DB_DIR "/pki-mapping",
"kdc", "kdc",
"pki-mappings-file", "pki-mappings-file",
NULL); NULL);
f = fopen(mapping_file, "r"); f = fopen(file, "r");
if (f == NULL) { if (f == NULL) {
krb5_warnx(context, "PKINIT: failed to load mappings file %s", krb5_warnx(context, "PKINIT: failed to load mappings file %s", file);
mapping_file);
return 0; return 0;
} }