src/sss_client/sssd_pac.c

90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose/*
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    Authors:
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        Sumit Bose <sbose@redhat.com>
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    Copyright (C) 2011, 2012, 2013 Red Hat
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    This program is free software; you can redistribute it and/or modify
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    it under the terms of the GNU Lesser General Public License as published by
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    the Free Software Foundation; either version 3 of the License, or
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    (at your option) any later version.
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    This program is distributed in the hope that it will be useful,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    but WITHOUT ANY WARRANTY; without even the implied warranty of
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    GNU Lesser General Public License for more details.
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    You should have received a copy of the GNU Lesser General Public License
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    along with this program.  If not, see <http://www.gnu.org/licenses/>.
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose*/
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose/* A short documentation about authdata plugins can be found in
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose * http://http://k5wiki.kerberos.org/wiki/Projects/VerifyAuthData */
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose#include <krb5/krb5.h>
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose#include <errno.h>
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose#include "krb5_authdata_int.h"
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose#include "sss_cli.h"
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestruct sssd_context {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    krb5_data data;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose};
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic krb5_error_code
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_init(krb5_context kcontext, void **plugin_context)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *plugin_context = NULL;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    return 0;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic void
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_flags(krb5_context kcontext,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose              void *plugin_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose              krb5_authdatatype ad_type,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose              krb5_flags *flags)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    *flags = AD_USAGE_KDC_ISSUED | AD_USAGE_TGS_REQ;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic void
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_fini(krb5_context kcontext, void *plugin_context)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    return;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic krb5_error_code
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_request_init(krb5_context kcontext,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                     krb5_authdata_context context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                     void *plugin_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                     void **request_context)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    struct sssd_context *sssdctx;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdctx = (struct sssd_context *)calloc(1, sizeof(*sssdctx));
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (sssdctx == NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        return ENOMEM;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *request_context = sssdctx;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    return 0;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic krb5_error_code
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_import_authdata(krb5_context kcontext,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                        krb5_authdata_context context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                        void *plugin_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                        void *request_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                        krb5_authdata **authdata,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                        krb5_boolean kdc_issued,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                        krb5_const_principal kdc_issuer)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    char *data = NULL;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    struct sssd_context *sssdctx = (struct sssd_context *)request_context;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (authdata[0] == NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        return EINVAL;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (authdata[0]->length > 0) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        data = malloc(sizeof(char) * authdata[0]->length);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        if (data == NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose            return ENOMEM;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        memcpy(data, authdata[0]->contents, authdata[0]->length);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (sssdctx->data.data != NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        krb5_free_data_contents(kcontext, &sssdctx->data);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdctx->data.length = authdata[0]->length;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdctx->data.data = data;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    return 0;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic void
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_request_fini(krb5_context kcontext,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                     krb5_authdata_context context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                     void *plugin_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                     void *request_context)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    struct sssd_context *sssdctx = (struct sssd_context *)request_context;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (sssdctx != NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        if (sssdctx->data.data != NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose            krb5_free_data_contents(kcontext, &sssdctx->data);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        free(sssdctx);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bosestatic krb5_error_code sssdpac_verify(krb5_context kcontext,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                                      krb5_authdata_context context,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                                      void *plugin_context,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                                      void *request_context,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                                      const krb5_auth_context *auth_context,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                                      const krb5_keyblock *key,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                                      const krb5_ap_req *req)
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose{
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    krb5_error_code kerr;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    int ret;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    krb5_pac pac;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    struct sssd_context *sssdctx = (struct sssd_context *)request_context;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    struct sss_cli_req_data sss_data;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    int errnop;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    if (sssdctx == NULL || sssdctx->data.data == NULL) {
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose        return EINVAL;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    }
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    kerr = krb5_pac_parse(kcontext, sssdctx->data.data,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                          sssdctx->data.length, &pac);
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    if (kerr != 0) {
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose        return EINVAL;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    }
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    kerr = krb5_pac_verify(kcontext, pac,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                           req->ticket->enc_part2->times.authtime,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                           req->ticket->enc_part2->client, key, NULL);
b4c44ebb8997d3debb33607c123ccfd9926e0cbaThomas Oulevey    /* deallocate pac */
b4c44ebb8997d3debb33607c123ccfd9926e0cbaThomas Oulevey    krb5_pac_free(kcontext, pac);
b4c44ebb8997d3debb33607c123ccfd9926e0cbaThomas Oulevey    pac = NULL;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    if (kerr != 0) {
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek        /* The krb5 documentation says:
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek         * A checksum mismatch can occur if the PAC was copied from a
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek         * cross-realm TGT by an ignorant KDC; also Apple Mac OS X Server
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek         * Open Directory (as of 10.6) generates PACs with no server checksum
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek         * at all. One should consider not failing the whole authentication
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek         * because of this reason, but, instead, treating the ticket as
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek         * if it did not contain a PAC or marking the PAC information as
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek         * non-verified.
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek         */
6e51d44a65b15c2f0491b0a8b452caac0bc00584Jakub Hrozek        return 0;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    }
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    sss_data.len = sssdctx->data.length;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    sss_data.data = sssdctx->data.data;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    ret = sss_pac_make_request(SSS_PAC_ADD_PAC_USER, &sss_data,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose                               NULL, NULL, &errnop);
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    if (ret != 0) {
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose        /* Ignore the error */
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    }
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    return 0;
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose}
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic krb5_error_code
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_size(krb5_context kcontext,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose             krb5_authdata_context context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose             void *plugin_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose             void *request_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose             size_t *sizep)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    struct sssd_context *sssdctx = (struct sssd_context *)request_context;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *sizep += sizeof(krb5_int32);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *sizep += sssdctx->data.length;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *sizep += sizeof(krb5_int32);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    return 0;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic krb5_error_code
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_externalize(krb5_context kcontext,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    krb5_authdata_context context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    void *plugin_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    void *request_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    krb5_octet **buffer,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    size_t *lenremain)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    krb5_error_code code = 0;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    struct sssd_context *sssdctx = (struct sssd_context *)request_context;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    size_t required = 0;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    krb5_octet *bp;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    size_t remain;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    bp = *buffer;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    remain = *lenremain;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (sssdctx->data.data != NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        sssdpac_size(kcontext, context, plugin_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                   request_context, &required);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        if (required <= remain) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose            krb5_ser_pack_int32((krb5_int32)sssdctx->data.length,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                                &bp, &remain);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose            krb5_ser_pack_bytes((krb5_octet *)sssdctx->data.data,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                                (size_t)sssdctx->data.length,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                                &bp, &remain);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose            krb5_ser_pack_int32(0,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                                &bp, &remain);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        } else {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose            code = ENOMEM;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    } else {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        krb5_ser_pack_int32(0, &bp, &remain); /* length */
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        krb5_ser_pack_int32(0, &bp, &remain); /* verified */
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *buffer = bp;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *lenremain = remain;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    return code;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic krb5_error_code
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosesssdpac_internalize(krb5_context kcontext,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    krb5_authdata_context context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    void *plugin_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    void *request_context,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    krb5_octet **buffer,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose                    size_t *lenremain)
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose{
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    struct sssd_context *sssdctx = (struct sssd_context *)request_context;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    krb5_error_code code;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    krb5_int32 ibuf;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    krb5_octet *bp;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    size_t remain;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    krb5_data data;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    bp = *buffer;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    remain = *lenremain;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    /* length */
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    code = krb5_ser_unpack_int32(&ibuf, &bp, &remain);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (code != 0) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        return code;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (ibuf != 0) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        data.length = ibuf;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        data.data = malloc(sizeof(char) * ibuf);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        if (data.data == NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose            return ENOMEM;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        memcpy(data.data, bp, ibuf);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        bp += ibuf;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        remain -= ibuf;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    } else {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        data.length = 0;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        data.data = NULL;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    /* verified */
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    code = krb5_ser_unpack_int32(&ibuf, &bp, &remain);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (code != 0) {
76faa85577e4f715af3b61ec01f522587ca30304Lukas Slebodnik        free(data.data);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        return code;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    if (sssdctx->data.data != NULL) {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose        krb5_free_data_contents(kcontext, &sssdctx->data);
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    }
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdctx->data.length = data.length;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdctx->data.data = data.data;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *buffer = bp;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    *lenremain = remain;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    return 0;
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose}
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosestatic krb5_authdatatype sssdpac_ad_types[] = { KRB5_AUTHDATA_WIN2K_PAC, 0 };
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bosekrb5plugin_authdata_client_ftable_v0 authdata_client_0 = {
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    ((void *)((uintptr_t)("sssd_sssdpac"))),
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_ad_types,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_init,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_fini,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_flags,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_request_init,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_request_fini,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    NULL,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    NULL,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    NULL,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    NULL,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    NULL,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_import_authdata,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    NULL,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    NULL,
92af6f25864b5c389b57d0f659686801b45ca58cSumit Bose    sssdpac_verify,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_size,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_externalize,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    sssdpac_internalize,
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose    NULL
90fd1bbd6035cdab46faa3a695a2fb2be6508b17Sumit Bose};