oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Add pool of certificates to help certificate path building for clients

Browse Source 
sending incomplete path in the signedData.


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@16854 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2006-03-28 19:57:25 +00:00
parent 4d27cc0683
commit 945efb8a96
2 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
kdc/pkinit.c
View File

@@ -51,7 +51,7 @@ struct krb5_pk_identity {
hx509_verify_ctx verify_ctx; hx509_verify_ctx verify_ctx;
hx509_certs certs; hx509_certs certs;
hx509_certs anchors; hx509_certs anchors;
hx509_certs chain; hx509_certs certpool;
}; };
enum pkinit_type { enum pkinit_type {
@@ -566,12 +566,15 @@ _kdc_pk_rd_padata(krb5_context context,
kdc_identity->verify_ctx, kdc_identity->verify_ctx,
signed_content.data, signed_content.data,
signed_content.length, signed_content.length,
kdc_identity->certs, kdc_identity->certpool,
&eContentType, &eContentType,
&eContent, &eContent,
&signer_certs); &signer_certs);
if (ret) if (ret) {
kdc_log(context, config, 0,
"PK-INIT failed to verify signature %d", ret);
goto out; goto out;
}
ret = hx509_get_one_cert(kdc_identity->hx509ctx, signer_certs, ret = hx509_get_one_cert(kdc_identity->hx509ctx, signer_certs,
&client_params->cert); &client_params->cert);
@@ -1235,7 +1238,7 @@ _kdc_pk_initialize(krb5_context context,
krb5_kdc_configuration *config, krb5_kdc_configuration *config,
const char *user_id, const char *user_id,
const char *anchors, const char *anchors,
char **chain) char **pool)
{ {
const char *file; const char *file;
krb5_error_code ret; krb5_error_code ret;
@@ -1257,7 +1260,7 @@ _kdc_pk_initialize(krb5_context context,
&kdc_identity, &kdc_identity,
user_id, user_id,
anchors, anchors,
chain, pool,
NULL, NULL,
NULL, NULL,
NULL); NULL);

15
lib/krb5/pkinit.c
View File

@@ -68,7 +68,7 @@ struct krb5_pk_identity {
hx509_verify_ctx verify_ctx; hx509_verify_ctx verify_ctx;
hx509_certs certs; hx509_certs certs;
hx509_certs anchors; hx509_certs anchors;
hx509_certs chain; hx509_certs certpool;
}; };
struct krb5_pk_cert { struct krb5_pk_cert {
@@ -523,7 +523,7 @@ _krb5_pk_verify_sign(krb5_context context,
id->verify_ctx, id->verify_ctx,
data, data,
length, length,
id->certs, id->certpool,
contentType, contentType,
content, content,
&signer_certs); &signer_certs);
@@ -1207,12 +1207,12 @@ _krb5_pk_load_openssl_id(krb5_context context,
goto out; goto out;
ret = hx509_certs_init(id->hx509ctx, "MEMORY:pkinit-cert-chain", ret = hx509_certs_init(id->hx509ctx, "MEMORY:pkinit-cert-chain",
0, NULL, &id->chain); 0, NULL, &id->certpool);
if (ret) if (ret)
goto out; goto out;
while (chain && *chain) { while (chain && *chain) {
ret = hx509_certs_append(id->hx509ctx, id->chain, NULL, *chain); ret = hx509_certs_append(id->hx509ctx, id->certpool, NULL, *chain);
if (ret) { if (ret) {
krb5_set_error_string(context, krb5_set_error_string(context,
"pkinit failed to load chain %s", "pkinit failed to load chain %s",
@@ -1233,7 +1233,7 @@ out:
hx509_verify_destroy_ctx(id->verify_ctx); hx509_verify_destroy_ctx(id->verify_ctx);
hx509_certs_free(&id->certs); hx509_certs_free(&id->certs);
hx509_certs_free(&id->anchors); hx509_certs_free(&id->anchors);
hx509_certs_free(&id->chain); hx509_certs_free(&id->certpool);
hx509_context_free(&id->hx509ctx); hx509_context_free(&id->hx509ctx);
free(id); free(id);
} else } else
@@ -1518,7 +1518,7 @@ _krb5_get_init_creds_opt_free_pkinit(krb5_get_init_creds_opt *opt)
hx509_verify_destroy_ctx(ctx->id->verify_ctx); hx509_verify_destroy_ctx(ctx->id->verify_ctx);
hx509_certs_free(&ctx->id->certs); hx509_certs_free(&ctx->id->certs);
hx509_certs_free(&ctx->id->anchors); hx509_certs_free(&ctx->id->anchors);
hx509_certs_free(&ctx->id->chain); hx509_certs_free(&ctx->id->certpool);
hx509_context_free(&ctx->id->hx509ctx); hx509_context_free(&ctx->id->hx509ctx);
if (ctx->clientDHNonce) { if (ctx->clientDHNonce) {
@@ -1540,6 +1540,7 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
krb5_principal principal, krb5_principal principal,
const char *user_id, const char *user_id,
const char *x509_anchors, const char *x509_anchors,
const char **chain,
int flags, int flags,
krb5_prompter_fct prompter, krb5_prompter_fct prompter,
void *prompter_data, void *prompter_data,
@@ -1568,7 +1569,7 @@ krb5_get_init_creds_opt_set_pkinit(krb5_context context,
&opt->opt_private->pk_init_ctx->id, &opt->opt_private->pk_init_ctx->id,
user_id, user_id,
x509_anchors, x509_anchors,
NULL, chain,
prompter, prompter,
prompter_data, prompter_data,
password); password);