oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

no warnings

Browse Source
This commit is contained in:
Love Hornquist Astrand
2010-01-19 04:28:48 +00:00
committed by Love Hörnquist Åstrand
parent c148c2b432
commit 96299ac2bb
1 changed files with 44 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
kdc/kerberos5.c
View File

@@ -962,7 +962,7 @@ _kdc_as_rep(krb5_context context,
struct sockaddr *from_addr, struct sockaddr *from_addr,
int datagram_reply) int datagram_reply)
{ {
KDC_REQ_BODY *b; KDC_REQ_BODY *b = NULL;
AS_REP rep; AS_REP rep;
KDCOptions f; KDCOptions f;
hdb_entry_ex *client = NULL, *server = NULL; hdb_entry_ex *client = NULL, *server = NULL;
@@ -982,6 +982,7 @@ _kdc_as_rep(krb5_context context,
pk_client_params *pkp = NULL; pk_client_params *pkp = NULL;
#endif #endif
METHOD_DATA error_method; METHOD_DATA error_method;
krb5_crypto armor_crypto = NULL;
memset(&rep, 0, sizeof(rep)); memset(&rep, 0, sizeof(rep));
memset(&session_key, 0, sizeof(session_key)); memset(&session_key, 0, sizeof(session_key));
@@ -1087,7 +1088,7 @@ _kdc_as_rep(krb5_context context,
goto out; goto out;
} }
krb5_crypto crypto_subkey, crypto_session, armor_crypto = NULL; krb5_crypto crypto_subkey, crypto_session;
krb5_crypto_init(context, ac->remote_subkey, 0, &crypto_subkey); krb5_crypto_init(context, ac->remote_subkey, 0, &crypto_subkey);
krb5_crypto_init(context, ac->keyblock, 0, &crypto_session); krb5_crypto_init(context, ac->keyblock, 0, &crypto_session);
@@ -1140,6 +1141,8 @@ _kdc_as_rep(krb5_context context,
if (ret) if (ret)
goto out; goto out;
KrbFastReq fastreq;
ret = decode_KrbFastReq(data.data, data.length, &fastreq, &size); ret = decode_KrbFastReq(data.data, data.length, &fastreq, &size);
if (ret) { if (ret) {
krb5_data_free(&data); krb5_data_free(&data);
@@ -1168,7 +1171,7 @@ _kdc_as_rep(krb5_context context,
/* KDC MUST ignore outer pa data preauth-14 - 6.5.5 */ /* KDC MUST ignore outer pa data preauth-14 - 6.5.5 */
free_METHOD_DATA(req->padata); free_METHOD_DATA(req->padata);
ret = copy_METHOD_DATA(&fastreq.padata, pa->padata); ret = copy_METHOD_DATA(&fastreq.padata, req->padata);
if (ret) if (ret)
goto out; goto out;
@@ -1319,8 +1322,12 @@ _kdc_as_rep(krb5_context context,
i = 0; i = 0;
pa = _kdc_find_padata(req, &i, KRB5_PADATA_ENCRYPTED_CHALLENGE); pa = _kdc_find_padata(req, &i, KRB5_PADATA_ENCRYPTED_CHALLENGE);
if (pa && armor_key) { if (pa && armor_crypto) {
/* XXX handle encrypted challange */ /* XXX handle encrypted challange */
if (1)
goto pkinit;
} }
pkinit: pkinit:
@@ -1545,16 +1552,12 @@ _kdc_as_rep(krb5_context context,
|| client->entry.flags.require_preauth || client->entry.flags.require_preauth
|| server->entry.flags.require_preauth) { || server->entry.flags.require_preauth) {
PA_DATA *pa; PA_DATA *pa;
unsigned char *buf;
size_t len;
use_pa: use_pa:
ret = realloc_method_data(&error_method); ret = realloc_method_data(&error_method);
if (ret) { if (ret)
free_METHOD_DATA(&error_method);
goto out; goto out;
}
pa = &error_method.val[error_method.len-1]; pa = &error_method.val[error_method.len-1];
pa->padata_type = KRB5_PADATA_ENC_TIMESTAMP; pa->padata_type = KRB5_PADATA_ENC_TIMESTAMP;
pa->padata_value.length = 0; pa->padata_value.length = 0;
@@ -1562,20 +1565,16 @@ _kdc_as_rep(krb5_context context,
#ifdef PKINIT #ifdef PKINIT
ret = realloc_method_data(&error_method); ret = realloc_method_data(&error_method);
if (ret) { if (ret)
free_METHOD_DATA(&error_method);
goto out; goto out;
}
pa = &error_method.val[error_method.len-1]; pa = &error_method.val[error_method.len-1];
pa->padata_type = KRB5_PADATA_PK_AS_REQ; pa->padata_type = KRB5_PADATA_PK_AS_REQ;
pa->padata_value.length = 0; pa->padata_value.length = 0;
pa->padata_value.data = NULL; pa->padata_value.data = NULL;
ret = realloc_method_data(&error_method); ret = realloc_method_data(&error_method);
if (ret) { if (ret)
free_METHOD_DATA(&error_method);
goto out; goto out;
}
pa = &error_method.val[error_method.len-1]; pa = &error_method.val[error_method.len-1];
pa->padata_type = KRB5_PADATA_PK_AS_REQ_WIN; pa->padata_type = KRB5_PADATA_PK_AS_REQ_WIN;
pa->padata_value.length = 0; pa->padata_value.length = 0;
@@ -1585,10 +1584,8 @@ _kdc_as_rep(krb5_context context,
* Announce FX-FAST * Announce FX-FAST
*/ */
ret = realloc_method_data(&error_method); ret = realloc_method_data(&error_method);
if (ret) { if (ret)
free_METHOD_DATA(&error_method);
goto out; goto out;
}
pa = &error_method.val[error_method.len-1]; pa = &error_method.val[error_method.len-1];
pa->padata_type = KRB5_PADATA_FX_FAST; pa->padata_type = KRB5_PADATA_FX_FAST;
pa->padata_value.length = 0; pa->padata_value.length = 0;
@@ -1616,17 +1613,13 @@ _kdc_as_rep(krb5_context context,
if (older_enctype(ckey->key.keytype)) { if (older_enctype(ckey->key.keytype)) {
ret = get_pa_etype_info(context, config, ret = get_pa_etype_info(context, config,
&error_method, ckey); &error_method, ckey);
if (ret) { if (ret)
free_METHOD_DATA(&error_method);
goto out; goto out;
}
} }
ret = get_pa_etype_info2(context, config, ret = get_pa_etype_info2(context, config,
&error_method, ckey); &error_method, ckey);
if (ret) { if (ret)
free_METHOD_DATA(&error_method);
goto out; goto out;
}
} }
ret = KRB5KDC_ERR_PREAUTH_REQUIRED; ret = KRB5KDC_ERR_PREAUTH_REQUIRED;
@@ -2024,16 +2017,18 @@ out:
if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE){ if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE){
krb5_data e_data; krb5_data e_data;
krb5_const_principal error_client = client_princ; krb5_principal error_client = client_princ;
krb5_const_principal error_server = server_princ; krb5_principal error_server = server_princ;
size_t size;
krb5_data_zero(&e_data); krb5_data_zero(&e_data);
if (armor_key) { if (armor_crypto) {
PA_FX_FAST_REPLY fxfastrep; PA_FX_FAST_REPLY fxfastrep;
KRBFastResponse fastrep; KrbFastResponse fastrep;
PA_DATA *pa;
memeset(&fxfastrep, 0, sizeof(fxfastrep)); memset(&fxfastrep, 0, sizeof(fxfastrep));
memset(&fastrep, 0, sizeof(fastrep)); memset(&fastrep, 0, sizeof(fastrep));
/* first add the KRB-ERROR to the fast errors */ /* first add the KRB-ERROR to the fast errors */
@@ -2043,7 +2038,7 @@ out:
e_text, e_text,
NULL, NULL,
error_client, error_client,
error_client, error_server,
NULL, NULL,
NULL, NULL,
&e_data); &e_data);
@@ -2060,9 +2055,8 @@ out:
goto out2; goto out2;
pa = &error_method.val[error_method.len-1]; pa = &error_method.val[error_method.len-1];
pa->padata_type = KRB5_PADATA_FX_FAST_ERROR; pa->padata_type = KRB5_PADATA_FX_ERROR;
pa->padata_value.length = e_data.length; pa->padata_value = e_data;
pa->padata_value.length = e_data.data;
krb5_data_zero(&e_data); krb5_data_zero(&e_data);
@@ -2071,42 +2065,40 @@ out:
error_method.len = 0; error_method.len = 0;
fastrep.strengthen_key = NULL; fastrep.strengthen_key = NULL;
fastrep.finished = NULL; fastrep.finished = NULL;
fastrep.nonce = b->nonce; fastrep.nonce = req->req_body.nonce;
ASN1_MALLOC_ENCODE(KRBFastResponse, e_data.data, e_data.length, ASN1_MALLOC_ENCODE(KrbFastResponse, e_data.data, e_data.length,
&fastrep, &len, ret); &fastrep, &size, ret);
free_KRBFastResponse(&fastrep); free_KrbFastResponse(&fastrep);
if (ret) if (ret)
goto out2; goto out2;
if (e_data.length != len) if (e_data.length != size)
krb5_abortx(context, "internal asn.1 error"); krb5_abortx(context, "internal asn.1 error");
fxfastrep.element = choice_PA_FX_FAST_REPLY_armored_data; fxfastrep.element = choice_PA_FX_FAST_REPLY_armored_data;
ret = krb5_encrypt_EncryptedData(context, ret = krb5_encrypt_EncryptedData(context,
crypto, armor_crypto,
KRB5_KU_USAGE_REP, KRB5_KU_FAST_REP,
e_data.data, e_data.data,
e_data.length, e_data.length,
NULL, 0,
&fxfastrep.u.armored_data.enc_fast_rep); &fxfastrep.u.armored_data.enc_fast_rep);
krb5_data_free(&e_data); krb5_data_free(&e_data);
if (ret) if (ret)
goto out2; goto out2;
ASN1_MALLOC_ENCODE(PA_FX_FAST_REPLY, e_data.data, e_data.length, ASN1_MALLOC_ENCODE(PA_FX_FAST_REPLY, e_data.data, e_data.length,
&fxfastrep, &len, ret); &fxfastrep, &size, ret);
if (ret) if (ret)
goto out2; goto out2;
if (e_data.length != len) if (e_data.length != size)
krb5_abortx(context, "internal asn.1 error"); krb5_abortx(context, "internal asn.1 error");
ret = realloc_method_data(&error_method); ret = realloc_method_data(&error_method);
if (ret) { if (ret)
free_METHOD_DATA(&error_method);
goto out; goto out;
}
pa = &error_method.val[error_method.len-1]; pa = &error_method.val[error_method.len-1];
pa->padata_type = KRB5_PADATA_FX_FAST; pa->padata_type = KRB5_PADATA_FX_FAST;
pa->padata_value = e_data; pa->padata_value = e_data;
@@ -2115,11 +2107,10 @@ out:
if (error_method.len) { if (error_method.len) {
ASN1_MALLOC_ENCODE(METHOD_DATA, e_data.data, e_data.length, ASN1_MALLOC_ENCODE(METHOD_DATA, e_data.data, e_data.length,
&error_method, &len, ret); &error_method, &size, ret);
free_METHOD_DATA(&error_method);
if (ret) if (ret)
goto out2; goto out2;
if (e_data.length != len) if (e_data.length != size)
krb5_abortx(context, "internal asn.1 error"); krb5_abortx(context, "internal asn.1 error");
} }
@@ -2135,12 +2126,14 @@ out:
krb5_data_free(&e_data); krb5_data_free(&e_data);
} }
out2: out2:
if (armor_crypto)
krb5_crypto_destroy(context, armor_crypto);
#ifdef PKINIT #ifdef PKINIT
if (pkp) if (pkp)
_kdc_pk_free_client_param(context, pkp); _kdc_pk_free_client_param(context, pkp);
#endif #endif
if (e_data.data) if (error_method.len)
free(e_data.data); free_METHOD_DATA(&error_method);
if (client_princ) if (client_princ)
krb5_free_principal(context, client_princ); krb5_free_principal(context, client_princ);
free(client_name); free(client_name);