rd_req_dec.c revision ba7b222e36bac28710a7f43739283302b617e7f5
/*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/*
*
* Copyright (c) 1994 CyberSAFE Corporation.
* Copyright 1990,1991 by the Massachusetts Institute of Technology.
* All Rights Reserved.
*
* Export of this software from the United States of America may
* require a specific license from the United States Government.
* It is the responsibility of any person or organization contemplating
* export to obtain such a license before exporting.
*
* WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
* distribute this software and its documentation for any purpose and
* without fee is hereby granted, provided that the above copyright
* notice appear in all copies and that both that copyright notice and
* this permission notice appear in supporting documentation, and that
* the name of M.I.T. not be used in advertising or publicity pertaining
* to distribution of the software without specific, written prior
* permission. Furthermore if you modify this software you must label
* your software as modified software and not distribute it in such a
* fashion that it might be confused with the original M.I.T. software.
* Neither M.I.T., the Open Computing Security Group, nor
* CyberSAFE Corporation make any representations about the suitability of
* this software for any purpose. It is provided "as is" without express
* or implied warranty.
*
*
* krb5_rd_req_decoded()
*/
#include "k5-int.h"
#include "auth_con.h"
/*
* essentially the same as krb_rd_req, but uses a decoded AP_REQ as
* the input rather than an encoded input.
*/
/*
* Parses a KRB_AP_REQ message, returning its contents.
*
* server specifies the expected server's name for the ticket; if NULL, then
* any server will be accepted if the key can be found, and the caller should
* verify that the principal is something it trusts.
*
* rcache specifies a replay detection cache used to store authenticators and
* server names
*
* keyproc specifies a procedure to generate a decryption key for the
* ticket. If keyproc is non-NULL, keyprocarg is passed to it, and the result
* used as a decryption key. If keyproc is NULL, then fetchfrom is checked;
* if it is non-NULL, it specifies a parameter name from which to retrieve the
* decryption key. If fetchfrom is NULL, then the default key store is
* consulted.
*
* authdat is set to point at allocated storage structures; the caller
* should free them when finished.
*
* returns system errors, encryption errors, replay errors
*/
int);
static krb5_error_code
{
/* Solaris Kerberos: */
return retval;
/*
* Solaris Kerberos:
* If we get this far then we know that the enc types are similar,
* therefore we should change the enc type to match that of what
* we are decrypting.
*/
/* Upon error, Free keytab entry first, then return */
return retval;
}
static krb5_error_code
{
krb5_error_code retval = 0;
char *realm;
princ_data = *server;
server = &princ_data;
if (retval)
return retval;
}
char *found_name = 0, *wanted_name = 0;
"Wrong principal in request (found %s, wanted %s)",
goto cleanup;
}
/* if (req->ap_options & AP_OPTS_USE_SESSION_KEY)
do we need special processing here ? */
/* decrypt the ticket */
goto cleanup;
} else {
goto cleanup;
}
/* XXX this is an evil hack. check_valid_flag is set iff the call
is not from inside the kdc. we can use this to determine which
key usage to use */
&((*auth_context)->authentp),
goto cleanup;
goto cleanup;
}
if ((*auth_context)->remote_addr &&
goto cleanup;
}
/* okay, now check cross-realm policy */
#if defined(_SINGLE_HOP_ONLY)
/* Single hop cross-realm tickets only */
{
/* If the transited list is empty, then we have at most one hop */
}
#elif defined(_NO_CROSS_REALM)
/* No cross-realm tickets */
{
char * lrealm;
/*
* If the transited list is empty, then we have at most one hop
* So we also have to check that the client's realm is the local one
*/
}
}
#else
/* Hierarchical Cross-Realm */
{
/*
* If the transited list is not empty, then check that all realms
* transited are within the hierarchy between the client's realm
* and the local realm.
*/
server));
}
}
#endif
/* only check rcache if sender has provided one---some services
may not be able to use replay caches (such as datagram servers) */
if ((*auth_context)->rcache) {
}
if (retval)
goto cleanup;
}
if (retval != 0)
goto cleanup;
goto cleanup;
goto cleanup;
}
if (check_valid_flag) {
goto cleanup;
}
}
/* check if the various etypes are permitted */
/* no etype check needed */
/*EMPTY*/
;
int etype;
/* check against the default set */
if ((!krb5_is_permitted_enctype(context,
char enctype_name[30];
"Encryption type %s not permitted",
goto cleanup;
}
} else {
/* check against the set in the auth_context */
int i;
for (i=0; (*auth_context)->permitted_etypes[i]; i++)
if ((*auth_context)->permitted_etypes[i] ==
break;
if (!(*auth_context)->permitted_etypes[i]) {
char enctype_name[30];
enctype_name, sizeof(enctype_name)) == 0)
"Encryption type %s not permitted",
goto cleanup;
}
for (i=0; (*auth_context)->permitted_etypes[i]; i++)
if ((*auth_context)->permitted_etypes[i] ==
break;
if (!(*auth_context)->permitted_etypes[i]) {
char enctype_name[30];
enctype_name, sizeof(enctype_name)) == 0)
"Encryption type %s not permitted",
goto cleanup;
}
for (i=0; (*auth_context)->permitted_etypes[i]; i++)
if ((*auth_context)->permitted_etypes[i] ==
break;
if (!(*auth_context)->permitted_etypes[i]) {
char enctype_name[30];
sizeof(enctype_name)) == 0)
"Encryption type %s not permitted",
goto cleanup;
}
}
}
/* Solaris Kerberos */
}
&((*auth_context)->recv_subkey))))
goto cleanup;
/* Solaris Kerberos */
}
&((*auth_context)->send_subkey));
if (retval) {
goto cleanup;
}
} else {
(*auth_context)->recv_subkey = 0;
(*auth_context)->send_subkey = 0;
}
/* Solaris Kerberos */
}
&((*auth_context)->keyblock))))
goto cleanup;
/*
* If not AP_OPTS_MUTUAL_REQUIRED then and sequence numbers are used
* then the default sequence number is the one's complement of the
* sequence number sent ot us.
*/
(*auth_context)->remote_seq_number) {
(*auth_context)->local_seq_number ^=
}
if (ticket)
goto cleanup;
if (ap_req_options)
retval = 0;
if (server == &princ_data)
if (retval) {
/* only free if we're erroring out...otherwise some
applications will need the output. */
}
return retval;
}
{
1); /* check_valid_flag */
return retval;
}
const krb5_ap_req *req,
{
0); /* don't check_valid_flag */
return retval;
}
/*ARGSUSED*/
static krb5_error_code
{
return(ENOMEM);
return(retval);
}
/* now decode the decrypted stuff */
*authpp = local_auth;
}
return retval;
}
{
if (retval)
return retval;
return KRB5KRB_AP_ERR_SKEW;
return 0;
}