2
0

kssl.c 68 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218
  1. /* ssl/kssl.c -*- mode: C; c-file-style: "eay" -*- */
  2. /* Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project 2000.
  3. */
  4. /* ====================================================================
  5. * Copyright (c) 2000 The OpenSSL Project. All rights reserved.
  6. *
  7. * Redistribution and use in source and binary forms, with or without
  8. * modification, are permitted provided that the following conditions
  9. * are met:
  10. *
  11. * 1. Redistributions of source code must retain the above copyright
  12. * notice, this list of conditions and the following disclaimer.
  13. *
  14. * 2. Redistributions in binary form must reproduce the above copyright
  15. * notice, this list of conditions and the following disclaimer in
  16. * the documentation and/or other materials provided with the
  17. * distribution.
  18. *
  19. * 3. All advertising materials mentioning features or use of this
  20. * software must display the following acknowledgment:
  21. * "This product includes software developed by the OpenSSL Project
  22. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  23. *
  24. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  25. * endorse or promote products derived from this software without
  26. * prior written permission. For written permission, please contact
  27. * licensing@OpenSSL.org.
  28. *
  29. * 5. Products derived from this software may not be called "OpenSSL"
  30. * nor may "OpenSSL" appear in their names without prior written
  31. * permission of the OpenSSL Project.
  32. *
  33. * 6. Redistributions of any form whatsoever must retain the following
  34. * acknowledgment:
  35. * "This product includes software developed by the OpenSSL Project
  36. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  37. *
  38. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  39. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  40. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  41. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  42. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  43. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  44. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  45. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  46. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  47. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  48. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  49. * OF THE POSSIBILITY OF SUCH DAMAGE.
  50. * ====================================================================
  51. *
  52. * This product includes cryptographic software written by Eric Young
  53. * (eay@cryptsoft.com). This product includes software written by Tim
  54. * Hudson (tjh@cryptsoft.com).
  55. *
  56. */
  57. /* ssl/kssl.c -- Routines to support (& debug) Kerberos5 auth for openssl
  58. **
  59. ** 19990701 VRS Started.
  60. ** 200011?? Jeffrey Altman, Richard Levitte
  61. ** Generalized for Heimdal, Newer MIT, & Win32.
  62. ** Integrated into main OpenSSL 0.9.7 snapshots.
  63. ** 20010413 Simon Wilkinson, VRS
  64. ** Real RFC2712 KerberosWrapper replaces AP_REQ.
  65. */
  66. #include <openssl/opensslconf.h>
  67. #include <string.h>
  68. #define KRB5_PRIVATE 1
  69. #include <openssl/ssl.h>
  70. #include <openssl/evp.h>
  71. #include <openssl/objects.h>
  72. #include <openssl/krb5_asn.h>
  73. #include "kssl_lcl.h"
  74. #ifndef OPENSSL_NO_KRB5
  75. #ifndef ENOMEM
  76. #define ENOMEM KRB5KRB_ERR_GENERIC
  77. #endif
  78. /*
  79. * When OpenSSL is built on Windows, we do not want to require that
  80. * the Kerberos DLLs be available in order for the OpenSSL DLLs to
  81. * work. Therefore, all Kerberos routines are loaded at run time
  82. * and we do not link to a .LIB file.
  83. */
  84. #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32)
  85. /*
  86. * The purpose of the following pre-processor statements is to provide
  87. * compatibility with different releases of MIT Kerberos for Windows.
  88. * All versions up to 1.2 used macros. But macros do not allow for
  89. * a binary compatible interface for DLLs. Therefore, all macros are
  90. * being replaced by function calls. The following code will allow
  91. * an OpenSSL DLL built on Windows to work whether or not the macro
  92. * or function form of the routines are utilized.
  93. */
  94. #ifdef krb5_cc_get_principal
  95. #define NO_DEF_KRB5_CCACHE
  96. #undef krb5_cc_get_principal
  97. #endif
  98. #define krb5_cc_get_principal kssl_krb5_cc_get_principal
  99. #define krb5_free_data_contents kssl_krb5_free_data_contents
  100. #define krb5_free_context kssl_krb5_free_context
  101. #define krb5_auth_con_free kssl_krb5_auth_con_free
  102. #define krb5_free_principal kssl_krb5_free_principal
  103. #define krb5_mk_req_extended kssl_krb5_mk_req_extended
  104. #define krb5_get_credentials kssl_krb5_get_credentials
  105. #define krb5_cc_default kssl_krb5_cc_default
  106. #define krb5_sname_to_principal kssl_krb5_sname_to_principal
  107. #define krb5_init_context kssl_krb5_init_context
  108. #define krb5_free_ticket kssl_krb5_free_ticket
  109. #define krb5_rd_req kssl_krb5_rd_req
  110. #define krb5_kt_default kssl_krb5_kt_default
  111. #define krb5_kt_resolve kssl_krb5_kt_resolve
  112. /* macros in mit 1.2.2 and earlier; functions in mit 1.2.3 and greater */
  113. #ifndef krb5_kt_close
  114. #define krb5_kt_close kssl_krb5_kt_close
  115. #endif /* krb5_kt_close */
  116. #ifndef krb5_kt_get_entry
  117. #define krb5_kt_get_entry kssl_krb5_kt_get_entry
  118. #endif /* krb5_kt_get_entry */
  119. #define krb5_auth_con_init kssl_krb5_auth_con_init
  120. #define krb5_principal_compare kssl_krb5_principal_compare
  121. #define krb5_decrypt_tkt_part kssl_krb5_decrypt_tkt_part
  122. #define krb5_timeofday kssl_krb5_timeofday
  123. #define krb5_rc_default kssl_krb5_rc_default
  124. #ifdef krb5_rc_initialize
  125. #undef krb5_rc_initialize
  126. #endif
  127. #define krb5_rc_initialize kssl_krb5_rc_initialize
  128. #ifdef krb5_rc_get_lifespan
  129. #undef krb5_rc_get_lifespan
  130. #endif
  131. #define krb5_rc_get_lifespan kssl_krb5_rc_get_lifespan
  132. #ifdef krb5_rc_destroy
  133. #undef krb5_rc_destroy
  134. #endif
  135. #define krb5_rc_destroy kssl_krb5_rc_destroy
  136. #define valid_cksumtype kssl_valid_cksumtype
  137. #define krb5_checksum_size kssl_krb5_checksum_size
  138. #define krb5_kt_free_entry kssl_krb5_kt_free_entry
  139. #define krb5_auth_con_setrcache kssl_krb5_auth_con_setrcache
  140. #define krb5_auth_con_getrcache kssl_krb5_auth_con_getrcache
  141. #define krb5_get_server_rcache kssl_krb5_get_server_rcache
  142. /* Prototypes for built in stubs */
  143. void kssl_krb5_free_data_contents(krb5_context, krb5_data *);
  144. void kssl_krb5_free_principal(krb5_context, krb5_principal );
  145. krb5_error_code kssl_krb5_kt_resolve(krb5_context,
  146. krb5_const char *,
  147. krb5_keytab *);
  148. krb5_error_code kssl_krb5_kt_default(krb5_context,
  149. krb5_keytab *);
  150. krb5_error_code kssl_krb5_free_ticket(krb5_context, krb5_ticket *);
  151. krb5_error_code kssl_krb5_rd_req(krb5_context, krb5_auth_context *,
  152. krb5_const krb5_data *,
  153. krb5_const_principal, krb5_keytab,
  154. krb5_flags *,krb5_ticket **);
  155. krb5_boolean kssl_krb5_principal_compare(krb5_context, krb5_const_principal,
  156. krb5_const_principal);
  157. krb5_error_code kssl_krb5_mk_req_extended(krb5_context,
  158. krb5_auth_context *,
  159. krb5_const krb5_flags,
  160. krb5_data *,
  161. krb5_creds *,
  162. krb5_data * );
  163. krb5_error_code kssl_krb5_init_context(krb5_context *);
  164. void kssl_krb5_free_context(krb5_context);
  165. krb5_error_code kssl_krb5_cc_default(krb5_context,krb5_ccache *);
  166. krb5_error_code kssl_krb5_sname_to_principal(krb5_context,
  167. krb5_const char *,
  168. krb5_const char *,
  169. krb5_int32,
  170. krb5_principal *);
  171. krb5_error_code kssl_krb5_get_credentials(krb5_context,
  172. krb5_const krb5_flags,
  173. krb5_ccache,
  174. krb5_creds *,
  175. krb5_creds * *);
  176. krb5_error_code kssl_krb5_auth_con_init(krb5_context,
  177. krb5_auth_context *);
  178. krb5_error_code kssl_krb5_cc_get_principal(krb5_context context,
  179. krb5_ccache cache,
  180. krb5_principal *principal);
  181. krb5_error_code kssl_krb5_auth_con_free(krb5_context,krb5_auth_context);
  182. size_t kssl_krb5_checksum_size(krb5_context context,krb5_cksumtype ctype);
  183. krb5_boolean kssl_valid_cksumtype(krb5_cksumtype ctype);
  184. krb5_error_code krb5_kt_free_entry(krb5_context,krb5_keytab_entry FAR * );
  185. krb5_error_code kssl_krb5_auth_con_setrcache(krb5_context,
  186. krb5_auth_context,
  187. krb5_rcache);
  188. krb5_error_code kssl_krb5_get_server_rcache(krb5_context,
  189. krb5_const krb5_data *,
  190. krb5_rcache *);
  191. krb5_error_code kssl_krb5_auth_con_getrcache(krb5_context,
  192. krb5_auth_context,
  193. krb5_rcache *);
  194. /* Function pointers (almost all Kerberos functions are _stdcall) */
  195. static void (_stdcall *p_krb5_free_data_contents)(krb5_context, krb5_data *)
  196. =NULL;
  197. static void (_stdcall *p_krb5_free_principal)(krb5_context, krb5_principal )
  198. =NULL;
  199. static krb5_error_code(_stdcall *p_krb5_kt_resolve)
  200. (krb5_context, krb5_const char *, krb5_keytab *)=NULL;
  201. static krb5_error_code (_stdcall *p_krb5_kt_default)(krb5_context,
  202. krb5_keytab *)=NULL;
  203. static krb5_error_code (_stdcall *p_krb5_free_ticket)(krb5_context,
  204. krb5_ticket *)=NULL;
  205. static krb5_error_code (_stdcall *p_krb5_rd_req)(krb5_context,
  206. krb5_auth_context *,
  207. krb5_const krb5_data *,
  208. krb5_const_principal,
  209. krb5_keytab, krb5_flags *,
  210. krb5_ticket **)=NULL;
  211. static krb5_error_code (_stdcall *p_krb5_mk_req_extended)
  212. (krb5_context, krb5_auth_context *,
  213. krb5_const krb5_flags, krb5_data *, krb5_creds *,
  214. krb5_data * )=NULL;
  215. static krb5_error_code (_stdcall *p_krb5_init_context)(krb5_context *)=NULL;
  216. static void (_stdcall *p_krb5_free_context)(krb5_context)=NULL;
  217. static krb5_error_code (_stdcall *p_krb5_cc_default)(krb5_context,
  218. krb5_ccache *)=NULL;
  219. static krb5_error_code (_stdcall *p_krb5_sname_to_principal)
  220. (krb5_context, krb5_const char *, krb5_const char *,
  221. krb5_int32, krb5_principal *)=NULL;
  222. static krb5_error_code (_stdcall *p_krb5_get_credentials)
  223. (krb5_context, krb5_const krb5_flags, krb5_ccache,
  224. krb5_creds *, krb5_creds **)=NULL;
  225. static krb5_error_code (_stdcall *p_krb5_auth_con_init)
  226. (krb5_context, krb5_auth_context *)=NULL;
  227. static krb5_error_code (_stdcall *p_krb5_cc_get_principal)
  228. (krb5_context context, krb5_ccache cache,
  229. krb5_principal *principal)=NULL;
  230. static krb5_error_code (_stdcall *p_krb5_auth_con_free)
  231. (krb5_context, krb5_auth_context)=NULL;
  232. static krb5_error_code (_stdcall *p_krb5_decrypt_tkt_part)
  233. (krb5_context, krb5_const krb5_keyblock *,
  234. krb5_ticket *)=NULL;
  235. static krb5_error_code (_stdcall *p_krb5_timeofday)
  236. (krb5_context context, krb5_int32 *timeret)=NULL;
  237. static krb5_error_code (_stdcall *p_krb5_rc_default)
  238. (krb5_context context, krb5_rcache *rc)=NULL;
  239. static krb5_error_code (_stdcall *p_krb5_rc_initialize)
  240. (krb5_context context, krb5_rcache rc,
  241. krb5_deltat lifespan)=NULL;
  242. static krb5_error_code (_stdcall *p_krb5_rc_get_lifespan)
  243. (krb5_context context, krb5_rcache rc,
  244. krb5_deltat *lifespan)=NULL;
  245. static krb5_error_code (_stdcall *p_krb5_rc_destroy)
  246. (krb5_context context, krb5_rcache rc)=NULL;
  247. static krb5_boolean (_stdcall *p_krb5_principal_compare)
  248. (krb5_context, krb5_const_principal, krb5_const_principal)=NULL;
  249. static size_t (_stdcall *p_krb5_checksum_size)(krb5_context context,krb5_cksumtype ctype)=NULL;
  250. static krb5_boolean (_stdcall *p_valid_cksumtype)(krb5_cksumtype ctype)=NULL;
  251. static krb5_error_code (_stdcall *p_krb5_kt_free_entry)
  252. (krb5_context,krb5_keytab_entry * )=NULL;
  253. static krb5_error_code (_stdcall * p_krb5_auth_con_setrcache)(krb5_context,
  254. krb5_auth_context,
  255. krb5_rcache)=NULL;
  256. static krb5_error_code (_stdcall * p_krb5_get_server_rcache)(krb5_context,
  257. krb5_const krb5_data *,
  258. krb5_rcache *)=NULL;
  259. static krb5_error_code (* p_krb5_auth_con_getrcache)(krb5_context,
  260. krb5_auth_context,
  261. krb5_rcache *)=NULL;
  262. static krb5_error_code (_stdcall * p_krb5_kt_close)(krb5_context context,
  263. krb5_keytab keytab)=NULL;
  264. static krb5_error_code (_stdcall * p_krb5_kt_get_entry)(krb5_context context,
  265. krb5_keytab keytab,
  266. krb5_const_principal principal, krb5_kvno vno,
  267. krb5_enctype enctype, krb5_keytab_entry *entry)=NULL;
  268. static int krb5_loaded = 0; /* only attempt to initialize func ptrs once */
  269. /* Function to Load the Kerberos 5 DLL and initialize function pointers */
  270. void
  271. load_krb5_dll(void)
  272. {
  273. HANDLE hKRB5_32;
  274. krb5_loaded++;
  275. hKRB5_32 = LoadLibrary(TEXT("KRB5_32"));
  276. if (!hKRB5_32)
  277. return;
  278. (FARPROC) p_krb5_free_data_contents =
  279. GetProcAddress( hKRB5_32, "krb5_free_data_contents" );
  280. (FARPROC) p_krb5_free_context =
  281. GetProcAddress( hKRB5_32, "krb5_free_context" );
  282. (FARPROC) p_krb5_auth_con_free =
  283. GetProcAddress( hKRB5_32, "krb5_auth_con_free" );
  284. (FARPROC) p_krb5_free_principal =
  285. GetProcAddress( hKRB5_32, "krb5_free_principal" );
  286. (FARPROC) p_krb5_mk_req_extended =
  287. GetProcAddress( hKRB5_32, "krb5_mk_req_extended" );
  288. (FARPROC) p_krb5_get_credentials =
  289. GetProcAddress( hKRB5_32, "krb5_get_credentials" );
  290. (FARPROC) p_krb5_cc_get_principal =
  291. GetProcAddress( hKRB5_32, "krb5_cc_get_principal" );
  292. (FARPROC) p_krb5_cc_default =
  293. GetProcAddress( hKRB5_32, "krb5_cc_default" );
  294. (FARPROC) p_krb5_sname_to_principal =
  295. GetProcAddress( hKRB5_32, "krb5_sname_to_principal" );
  296. (FARPROC) p_krb5_init_context =
  297. GetProcAddress( hKRB5_32, "krb5_init_context" );
  298. (FARPROC) p_krb5_free_ticket =
  299. GetProcAddress( hKRB5_32, "krb5_free_ticket" );
  300. (FARPROC) p_krb5_rd_req =
  301. GetProcAddress( hKRB5_32, "krb5_rd_req" );
  302. (FARPROC) p_krb5_principal_compare =
  303. GetProcAddress( hKRB5_32, "krb5_principal_compare" );
  304. (FARPROC) p_krb5_decrypt_tkt_part =
  305. GetProcAddress( hKRB5_32, "krb5_decrypt_tkt_part" );
  306. (FARPROC) p_krb5_timeofday =
  307. GetProcAddress( hKRB5_32, "krb5_timeofday" );
  308. (FARPROC) p_krb5_rc_default =
  309. GetProcAddress( hKRB5_32, "krb5_rc_default" );
  310. (FARPROC) p_krb5_rc_initialize =
  311. GetProcAddress( hKRB5_32, "krb5_rc_initialize" );
  312. (FARPROC) p_krb5_rc_get_lifespan =
  313. GetProcAddress( hKRB5_32, "krb5_rc_get_lifespan" );
  314. (FARPROC) p_krb5_rc_destroy =
  315. GetProcAddress( hKRB5_32, "krb5_rc_destroy" );
  316. (FARPROC) p_krb5_kt_default =
  317. GetProcAddress( hKRB5_32, "krb5_kt_default" );
  318. (FARPROC) p_krb5_kt_resolve =
  319. GetProcAddress( hKRB5_32, "krb5_kt_resolve" );
  320. (FARPROC) p_krb5_auth_con_init =
  321. GetProcAddress( hKRB5_32, "krb5_auth_con_init" );
  322. (FARPROC) p_valid_cksumtype =
  323. GetProcAddress( hKRB5_32, "valid_cksumtype" );
  324. (FARPROC) p_krb5_checksum_size =
  325. GetProcAddress( hKRB5_32, "krb5_checksum_size" );
  326. (FARPROC) p_krb5_kt_free_entry =
  327. GetProcAddress( hKRB5_32, "krb5_kt_free_entry" );
  328. (FARPROC) p_krb5_auth_con_setrcache =
  329. GetProcAddress( hKRB5_32, "krb5_auth_con_setrcache" );
  330. (FARPROC) p_krb5_get_server_rcache =
  331. GetProcAddress( hKRB5_32, "krb5_get_server_rcache" );
  332. (FARPROC) p_krb5_auth_con_getrcache =
  333. GetProcAddress( hKRB5_32, "krb5_auth_con_getrcache" );
  334. (FARPROC) p_krb5_kt_close =
  335. GetProcAddress( hKRB5_32, "krb5_kt_close" );
  336. (FARPROC) p_krb5_kt_get_entry =
  337. GetProcAddress( hKRB5_32, "krb5_kt_get_entry" );
  338. }
  339. /* Stubs for each function to be dynamicly loaded */
  340. void
  341. kssl_krb5_free_data_contents(krb5_context CO, krb5_data * data)
  342. {
  343. if (!krb5_loaded)
  344. load_krb5_dll();
  345. if ( p_krb5_free_data_contents )
  346. p_krb5_free_data_contents(CO,data);
  347. }
  348. krb5_error_code
  349. kssl_krb5_mk_req_extended (krb5_context CO,
  350. krb5_auth_context * pACO,
  351. krb5_const krb5_flags F,
  352. krb5_data * pD1,
  353. krb5_creds * pC,
  354. krb5_data * pD2)
  355. {
  356. if (!krb5_loaded)
  357. load_krb5_dll();
  358. if ( p_krb5_mk_req_extended )
  359. return(p_krb5_mk_req_extended(CO,pACO,F,pD1,pC,pD2));
  360. else
  361. return KRB5KRB_ERR_GENERIC;
  362. }
  363. krb5_error_code
  364. kssl_krb5_auth_con_init(krb5_context CO,
  365. krb5_auth_context * pACO)
  366. {
  367. if (!krb5_loaded)
  368. load_krb5_dll();
  369. if ( p_krb5_auth_con_init )
  370. return(p_krb5_auth_con_init(CO,pACO));
  371. else
  372. return KRB5KRB_ERR_GENERIC;
  373. }
  374. krb5_error_code
  375. kssl_krb5_auth_con_free (krb5_context CO,
  376. krb5_auth_context ACO)
  377. {
  378. if (!krb5_loaded)
  379. load_krb5_dll();
  380. if ( p_krb5_auth_con_free )
  381. return(p_krb5_auth_con_free(CO,ACO));
  382. else
  383. return KRB5KRB_ERR_GENERIC;
  384. }
  385. krb5_error_code
  386. kssl_krb5_get_credentials(krb5_context CO,
  387. krb5_const krb5_flags F,
  388. krb5_ccache CC,
  389. krb5_creds * pCR,
  390. krb5_creds ** ppCR)
  391. {
  392. if (!krb5_loaded)
  393. load_krb5_dll();
  394. if ( p_krb5_get_credentials )
  395. return(p_krb5_get_credentials(CO,F,CC,pCR,ppCR));
  396. else
  397. return KRB5KRB_ERR_GENERIC;
  398. }
  399. krb5_error_code
  400. kssl_krb5_sname_to_principal(krb5_context CO,
  401. krb5_const char * pC1,
  402. krb5_const char * pC2,
  403. krb5_int32 I,
  404. krb5_principal * pPR)
  405. {
  406. if (!krb5_loaded)
  407. load_krb5_dll();
  408. if ( p_krb5_sname_to_principal )
  409. return(p_krb5_sname_to_principal(CO,pC1,pC2,I,pPR));
  410. else
  411. return KRB5KRB_ERR_GENERIC;
  412. }
  413. krb5_error_code
  414. kssl_krb5_cc_default(krb5_context CO,
  415. krb5_ccache * pCC)
  416. {
  417. if (!krb5_loaded)
  418. load_krb5_dll();
  419. if ( p_krb5_cc_default )
  420. return(p_krb5_cc_default(CO,pCC));
  421. else
  422. return KRB5KRB_ERR_GENERIC;
  423. }
  424. krb5_error_code
  425. kssl_krb5_init_context(krb5_context * pCO)
  426. {
  427. if (!krb5_loaded)
  428. load_krb5_dll();
  429. if ( p_krb5_init_context )
  430. return(p_krb5_init_context(pCO));
  431. else
  432. return KRB5KRB_ERR_GENERIC;
  433. }
  434. void
  435. kssl_krb5_free_context(krb5_context CO)
  436. {
  437. if (!krb5_loaded)
  438. load_krb5_dll();
  439. if ( p_krb5_free_context )
  440. p_krb5_free_context(CO);
  441. }
  442. void
  443. kssl_krb5_free_principal(krb5_context c, krb5_principal p)
  444. {
  445. if (!krb5_loaded)
  446. load_krb5_dll();
  447. if ( p_krb5_free_principal )
  448. p_krb5_free_principal(c,p);
  449. }
  450. krb5_error_code
  451. kssl_krb5_kt_resolve(krb5_context con,
  452. krb5_const char * sz,
  453. krb5_keytab * kt)
  454. {
  455. if (!krb5_loaded)
  456. load_krb5_dll();
  457. if ( p_krb5_kt_resolve )
  458. return(p_krb5_kt_resolve(con,sz,kt));
  459. else
  460. return KRB5KRB_ERR_GENERIC;
  461. }
  462. krb5_error_code
  463. kssl_krb5_kt_default(krb5_context con,
  464. krb5_keytab * kt)
  465. {
  466. if (!krb5_loaded)
  467. load_krb5_dll();
  468. if ( p_krb5_kt_default )
  469. return(p_krb5_kt_default(con,kt));
  470. else
  471. return KRB5KRB_ERR_GENERIC;
  472. }
  473. krb5_error_code
  474. kssl_krb5_free_ticket(krb5_context con,
  475. krb5_ticket * kt)
  476. {
  477. if (!krb5_loaded)
  478. load_krb5_dll();
  479. if ( p_krb5_free_ticket )
  480. return(p_krb5_free_ticket(con,kt));
  481. else
  482. return KRB5KRB_ERR_GENERIC;
  483. }
  484. krb5_error_code
  485. kssl_krb5_rd_req(krb5_context con, krb5_auth_context * pacon,
  486. krb5_const krb5_data * data,
  487. krb5_const_principal princ, krb5_keytab keytab,
  488. krb5_flags * flags, krb5_ticket ** pptkt)
  489. {
  490. if (!krb5_loaded)
  491. load_krb5_dll();
  492. if ( p_krb5_rd_req )
  493. return(p_krb5_rd_req(con,pacon,data,princ,keytab,flags,pptkt));
  494. else
  495. return KRB5KRB_ERR_GENERIC;
  496. }
  497. krb5_boolean
  498. krb5_principal_compare(krb5_context con, krb5_const_principal princ1,
  499. krb5_const_principal princ2)
  500. {
  501. if (!krb5_loaded)
  502. load_krb5_dll();
  503. if ( p_krb5_principal_compare )
  504. return(p_krb5_principal_compare(con,princ1,princ2));
  505. else
  506. return KRB5KRB_ERR_GENERIC;
  507. }
  508. krb5_error_code
  509. krb5_decrypt_tkt_part(krb5_context con, krb5_const krb5_keyblock *keys,
  510. krb5_ticket *ticket)
  511. {
  512. if (!krb5_loaded)
  513. load_krb5_dll();
  514. if ( p_krb5_decrypt_tkt_part )
  515. return(p_krb5_decrypt_tkt_part(con,keys,ticket));
  516. else
  517. return KRB5KRB_ERR_GENERIC;
  518. }
  519. krb5_error_code
  520. krb5_timeofday(krb5_context con, krb5_int32 *timeret)
  521. {
  522. if (!krb5_loaded)
  523. load_krb5_dll();
  524. if ( p_krb5_timeofday )
  525. return(p_krb5_timeofday(con,timeret));
  526. else
  527. return KRB5KRB_ERR_GENERIC;
  528. }
  529. krb5_error_code
  530. krb5_rc_default(krb5_context con, krb5_rcache *rc)
  531. {
  532. if (!krb5_loaded)
  533. load_krb5_dll();
  534. if ( p_krb5_rc_default )
  535. return(p_krb5_rc_default(con,rc));
  536. else
  537. return KRB5KRB_ERR_GENERIC;
  538. }
  539. krb5_error_code
  540. krb5_rc_initialize(krb5_context con, krb5_rcache rc, krb5_deltat lifespan)
  541. {
  542. if (!krb5_loaded)
  543. load_krb5_dll();
  544. if ( p_krb5_rc_initialize )
  545. return(p_krb5_rc_initialize(con, rc, lifespan));
  546. else
  547. return KRB5KRB_ERR_GENERIC;
  548. }
  549. krb5_error_code
  550. krb5_rc_get_lifespan(krb5_context con, krb5_rcache rc, krb5_deltat *lifespanp)
  551. {
  552. if (!krb5_loaded)
  553. load_krb5_dll();
  554. if ( p_krb5_rc_get_lifespan )
  555. return(p_krb5_rc_get_lifespan(con, rc, lifespanp));
  556. else
  557. return KRB5KRB_ERR_GENERIC;
  558. }
  559. krb5_error_code
  560. krb5_rc_destroy(krb5_context con, krb5_rcache rc)
  561. {
  562. if (!krb5_loaded)
  563. load_krb5_dll();
  564. if ( p_krb5_rc_destroy )
  565. return(p_krb5_rc_destroy(con, rc));
  566. else
  567. return KRB5KRB_ERR_GENERIC;
  568. }
  569. size_t
  570. krb5_checksum_size(krb5_context context,krb5_cksumtype ctype)
  571. {
  572. if (!krb5_loaded)
  573. load_krb5_dll();
  574. if ( p_krb5_checksum_size )
  575. return(p_krb5_checksum_size(context, ctype));
  576. else
  577. return KRB5KRB_ERR_GENERIC;
  578. }
  579. krb5_boolean
  580. valid_cksumtype(krb5_cksumtype ctype)
  581. {
  582. if (!krb5_loaded)
  583. load_krb5_dll();
  584. if ( p_valid_cksumtype )
  585. return(p_valid_cksumtype(ctype));
  586. else
  587. return KRB5KRB_ERR_GENERIC;
  588. }
  589. krb5_error_code
  590. krb5_kt_free_entry(krb5_context con,krb5_keytab_entry * entry)
  591. {
  592. if (!krb5_loaded)
  593. load_krb5_dll();
  594. if ( p_krb5_kt_free_entry )
  595. return(p_krb5_kt_free_entry(con,entry));
  596. else
  597. return KRB5KRB_ERR_GENERIC;
  598. }
  599. /* Structure definitions */
  600. #ifndef NO_DEF_KRB5_CCACHE
  601. #ifndef krb5_x
  602. #define krb5_x(ptr,args) ((ptr)?((*(ptr)) args):(abort(),1))
  603. #define krb5_xc(ptr,args) ((ptr)?((*(ptr)) args):(abort(),(char*)0))
  604. #endif
  605. typedef krb5_pointer krb5_cc_cursor; /* cursor for sequential lookup */
  606. typedef struct _krb5_ccache
  607. {
  608. krb5_magic magic;
  609. struct _krb5_cc_ops FAR *ops;
  610. krb5_pointer data;
  611. } *krb5_ccache;
  612. typedef struct _krb5_cc_ops
  613. {
  614. krb5_magic magic;
  615. char *prefix;
  616. char * (KRB5_CALLCONV *get_name)
  617. (krb5_context, krb5_ccache);
  618. krb5_error_code (KRB5_CALLCONV *resolve)
  619. (krb5_context, krb5_ccache *, const char *);
  620. krb5_error_code (KRB5_CALLCONV *gen_new)
  621. (krb5_context, krb5_ccache *);
  622. krb5_error_code (KRB5_CALLCONV *init)
  623. (krb5_context, krb5_ccache, krb5_principal);
  624. krb5_error_code (KRB5_CALLCONV *destroy)
  625. (krb5_context, krb5_ccache);
  626. krb5_error_code (KRB5_CALLCONV *close)
  627. (krb5_context, krb5_ccache);
  628. krb5_error_code (KRB5_CALLCONV *store)
  629. (krb5_context, krb5_ccache, krb5_creds *);
  630. krb5_error_code (KRB5_CALLCONV *retrieve)
  631. (krb5_context, krb5_ccache,
  632. krb5_flags, krb5_creds *, krb5_creds *);
  633. krb5_error_code (KRB5_CALLCONV *get_princ)
  634. (krb5_context, krb5_ccache, krb5_principal *);
  635. krb5_error_code (KRB5_CALLCONV *get_first)
  636. (krb5_context, krb5_ccache, krb5_cc_cursor *);
  637. krb5_error_code (KRB5_CALLCONV *get_next)
  638. (krb5_context, krb5_ccache,
  639. krb5_cc_cursor *, krb5_creds *);
  640. krb5_error_code (KRB5_CALLCONV *end_get)
  641. (krb5_context, krb5_ccache, krb5_cc_cursor *);
  642. krb5_error_code (KRB5_CALLCONV *remove_cred)
  643. (krb5_context, krb5_ccache,
  644. krb5_flags, krb5_creds *);
  645. krb5_error_code (KRB5_CALLCONV *set_flags)
  646. (krb5_context, krb5_ccache, krb5_flags);
  647. } krb5_cc_ops;
  648. #endif /* NO_DEF_KRB5_CCACHE */
  649. krb5_error_code
  650. kssl_krb5_cc_get_principal
  651. (krb5_context context, krb5_ccache cache,
  652. krb5_principal *principal)
  653. {
  654. if ( p_krb5_cc_get_principal )
  655. return(p_krb5_cc_get_principal(context,cache,principal));
  656. else
  657. return(krb5_x
  658. ((cache)->ops->get_princ,(context, cache, principal)));
  659. }
  660. krb5_error_code
  661. kssl_krb5_auth_con_setrcache(krb5_context con, krb5_auth_context acon,
  662. krb5_rcache rcache)
  663. {
  664. if ( p_krb5_auth_con_setrcache )
  665. return(p_krb5_auth_con_setrcache(con,acon,rcache));
  666. else
  667. return KRB5KRB_ERR_GENERIC;
  668. }
  669. krb5_error_code
  670. kssl_krb5_get_server_rcache(krb5_context con, krb5_const krb5_data * data,
  671. krb5_rcache * rcache)
  672. {
  673. if ( p_krb5_get_server_rcache )
  674. return(p_krb5_get_server_rcache(con,data,rcache));
  675. else
  676. return KRB5KRB_ERR_GENERIC;
  677. }
  678. krb5_error_code
  679. kssl_krb5_auth_con_getrcache(krb5_context con, krb5_auth_context acon,
  680. krb5_rcache * prcache)
  681. {
  682. if ( p_krb5_auth_con_getrcache )
  683. return(p_krb5_auth_con_getrcache(con,acon, prcache));
  684. else
  685. return KRB5KRB_ERR_GENERIC;
  686. }
  687. krb5_error_code
  688. kssl_krb5_kt_close(krb5_context context, krb5_keytab keytab)
  689. {
  690. if ( p_krb5_kt_close )
  691. return(p_krb5_kt_close(context,keytab));
  692. else
  693. return KRB5KRB_ERR_GENERIC;
  694. }
  695. krb5_error_code
  696. kssl_krb5_kt_get_entry(krb5_context context, krb5_keytab keytab,
  697. krb5_const_principal principal, krb5_kvno vno,
  698. krb5_enctype enctype, krb5_keytab_entry *entry)
  699. {
  700. if ( p_krb5_kt_get_entry )
  701. return(p_krb5_kt_get_entry(context,keytab,principal,vno,enctype,entry));
  702. else
  703. return KRB5KRB_ERR_GENERIC;
  704. }
  705. #endif /* OPENSSL_SYS_WINDOWS || OPENSSL_SYS_WIN32 */
  706. /* memory allocation functions for non-temporary storage
  707. * (e.g. stuff that gets saved into the kssl context) */
  708. static void* kssl_calloc(size_t nmemb, size_t size)
  709. {
  710. void* p;
  711. p=OPENSSL_malloc(nmemb*size);
  712. if (p){
  713. memset(p, 0, nmemb*size);
  714. }
  715. return p;
  716. }
  717. #define kssl_malloc(size) OPENSSL_malloc((size))
  718. #define kssl_realloc(ptr, size) OPENSSL_realloc(ptr, size)
  719. #define kssl_free(ptr) OPENSSL_free((ptr))
  720. char
  721. *kstring(char *string)
  722. {
  723. static char *null = "[NULL]";
  724. return ((string == NULL)? null: string);
  725. }
  726. /* Given KRB5 enctype (basically DES or 3DES),
  727. ** return closest match openssl EVP_ encryption algorithm.
  728. ** Return NULL for unknown or problematic (krb5_dk_encrypt) enctypes.
  729. ** Assume ENCTYPE_*_RAW (krb5_raw_encrypt) are OK.
  730. */
  731. const EVP_CIPHER *
  732. kssl_map_enc(krb5_enctype enctype)
  733. {
  734. switch (enctype)
  735. {
  736. case ENCTYPE_DES_HMAC_SHA1: /* EVP_des_cbc(); */
  737. case ENCTYPE_DES_CBC_CRC:
  738. case ENCTYPE_DES_CBC_MD4:
  739. case ENCTYPE_DES_CBC_MD5:
  740. case ENCTYPE_DES_CBC_RAW:
  741. return EVP_des_cbc();
  742. break;
  743. case ENCTYPE_DES3_CBC_SHA1: /* EVP_des_ede3_cbc(); */
  744. case ENCTYPE_DES3_CBC_SHA:
  745. case ENCTYPE_DES3_CBC_RAW:
  746. return EVP_des_ede3_cbc();
  747. break;
  748. default: return NULL;
  749. break;
  750. }
  751. }
  752. /* Return true:1 if p "looks like" the start of the real authenticator
  753. ** described in kssl_skip_confound() below. The ASN.1 pattern is
  754. ** "62 xx 30 yy" (APPLICATION-2, SEQUENCE), where xx-yy =~ 2, and
  755. ** xx and yy are possibly multi-byte length fields.
  756. */
  757. static int kssl_test_confound(unsigned char *p)
  758. {
  759. int len = 2;
  760. int xx = 0, yy = 0;
  761. if (*p++ != 0x62) return 0;
  762. if (*p > 0x82) return 0;
  763. switch(*p) {
  764. case 0x82: p++; xx = (*p++ << 8); xx += *p++; break;
  765. case 0x81: p++; xx = *p++; break;
  766. case 0x80: return 0;
  767. default: xx = *p++; break;
  768. }
  769. if (*p++ != 0x30) return 0;
  770. if (*p > 0x82) return 0;
  771. switch(*p) {
  772. case 0x82: p++; len+=2; yy = (*p++ << 8); yy += *p++; break;
  773. case 0x81: p++; len++; yy = *p++; break;
  774. case 0x80: return 0;
  775. default: yy = *p++; break;
  776. }
  777. return (xx - len == yy)? 1: 0;
  778. }
  779. /* Allocate, fill, and return cksumlens array of checksum lengths.
  780. ** This array holds just the unique elements from the krb5_cksumarray[].
  781. ** array[n] == 0 signals end of data.
  782. **
  783. ** The krb5_cksumarray[] was an internal variable that has since been
  784. ** replaced by a more general method for storing the data. It should
  785. ** not be used. Instead we use real API calls and make a guess for
  786. ** what the highest assigned CKSUMTYPE_ constant is. As of 1.2.2
  787. ** it is 0x000c (CKSUMTYPE_HMAC_SHA1_DES3). So we will use 0x0010.
  788. */
  789. static size_t *populate_cksumlens(void)
  790. {
  791. int i, j, n;
  792. static size_t *cklens = NULL;
  793. #ifdef KRB5_MIT_OLD11
  794. n = krb5_max_cksum;
  795. #else
  796. n = 0x0010;
  797. #endif /* KRB5_MIT_OLD11 */
  798. #ifdef KRB5CHECKAUTH
  799. if (!cklens && !(cklens = (size_t *) calloc(sizeof(int),n+1))) return NULL;
  800. for (i=0; i < n; i++) {
  801. if (!valid_cksumtype(i)) continue; /* array has holes */
  802. for (j=0; j < n; j++) {
  803. if (cklens[j] == 0) {
  804. cklens[j] = krb5_checksum_size(NULL,i);
  805. break; /* krb5 elem was new: add */
  806. }
  807. if (cklens[j] == krb5_checksum_size(NULL,i)) {
  808. break; /* ignore duplicate elements */
  809. }
  810. }
  811. }
  812. #endif /* KRB5CHECKAUTH */
  813. return cklens;
  814. }
  815. /* Return pointer to start of real authenticator within authenticator, or
  816. ** return NULL on error.
  817. ** Decrypted authenticator looks like this:
  818. ** [0 or 8 byte confounder] [4-24 byte checksum] [real authent'r]
  819. ** This hackery wouldn't be necessary if MIT KRB5 1.0.6 had the
  820. ** krb5_auth_con_getcksumtype() function advertised in its krb5.h.
  821. */
  822. unsigned char *kssl_skip_confound(krb5_enctype etype, unsigned char *a)
  823. {
  824. int i, conlen;
  825. size_t cklen;
  826. static size_t *cksumlens = NULL;
  827. unsigned char *test_auth;
  828. conlen = (etype)? 8: 0;
  829. if (!cksumlens && !(cksumlens = populate_cksumlens())) return NULL;
  830. for (i=0; (cklen = cksumlens[i]) != 0; i++)
  831. {
  832. test_auth = a + conlen + cklen;
  833. if (kssl_test_confound(test_auth)) return test_auth;
  834. }
  835. return NULL;
  836. }
  837. /* Set kssl_err error info when reason text is a simple string
  838. ** kssl_err = struct { int reason; char text[KSSL_ERR_MAX+1]; }
  839. */
  840. void
  841. kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text)
  842. {
  843. if (kssl_err == NULL) return;
  844. kssl_err->reason = reason;
  845. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, "%s", text);
  846. return;
  847. }
  848. /* Display contents of krb5_data struct, for debugging
  849. */
  850. void
  851. print_krb5_data(char *label, krb5_data *kdata)
  852. {
  853. int i;
  854. printf("%s[%d] ", label, kdata->length);
  855. for (i=0; i < (int)kdata->length; i++)
  856. {
  857. if (0 && isprint((int) kdata->data[i]))
  858. printf( "%c ", kdata->data[i]);
  859. else
  860. printf( "%02x ", (unsigned char) kdata->data[i]);
  861. }
  862. printf("\n");
  863. }
  864. /* Display contents of krb5_authdata struct, for debugging
  865. */
  866. void
  867. print_krb5_authdata(char *label, krb5_authdata **adata)
  868. {
  869. if (adata == NULL)
  870. {
  871. printf("%s, authdata==0\n", label);
  872. return;
  873. }
  874. printf("%s [%p]\n", label, (void *)adata);
  875. #if 0
  876. {
  877. int i;
  878. printf("%s[at%d:%d] ", label, adata->ad_type, adata->length);
  879. for (i=0; i < adata->length; i++)
  880. {
  881. printf((isprint(adata->contents[i]))? "%c ": "%02x",
  882. adata->contents[i]);
  883. }
  884. printf("\n");
  885. }
  886. #endif
  887. }
  888. /* Display contents of krb5_keyblock struct, for debugging
  889. */
  890. void
  891. print_krb5_keyblock(char *label, krb5_keyblock *keyblk)
  892. {
  893. int i;
  894. if (keyblk == NULL)
  895. {
  896. printf("%s, keyblk==0\n", label);
  897. return;
  898. }
  899. #ifdef KRB5_HEIMDAL
  900. printf("%s\n\t[et%d:%d]: ", label, keyblk->keytype,
  901. keyblk->keyvalue->length);
  902. for (i=0; i < (int)keyblk->keyvalue->length; i++)
  903. {
  904. printf("%02x",(unsigned char *)(keyblk->keyvalue->contents)[i]);
  905. }
  906. printf("\n");
  907. #else
  908. printf("%s\n\t[et%d:%d]: ", label, keyblk->enctype, keyblk->length);
  909. for (i=0; i < (int)keyblk->length; i++)
  910. {
  911. printf("%02x",keyblk->contents[i]);
  912. }
  913. printf("\n");
  914. #endif
  915. }
  916. /* Display contents of krb5_principal_data struct, for debugging
  917. ** (krb5_principal is typedef'd == krb5_principal_data *)
  918. */
  919. static void
  920. print_krb5_princ(char *label, krb5_principal_data *princ)
  921. {
  922. int i, ui, uj;
  923. printf("%s principal Realm: ", label);
  924. if (princ == NULL) return;
  925. for (ui=0; ui < (int)princ->realm.length; ui++) putchar(princ->realm.data[ui]);
  926. printf(" (nametype %d) has %d strings:\n", princ->type,princ->length);
  927. for (i=0; i < (int)princ->length; i++)
  928. {
  929. printf("\t%d [%d]: ", i, princ->data[i].length);
  930. for (uj=0; uj < (int)princ->data[i].length; uj++) {
  931. putchar(princ->data[i].data[uj]);
  932. }
  933. printf("\n");
  934. }
  935. return;
  936. }
  937. /* Given krb5 service (typically "kssl") and hostname in kssl_ctx,
  938. ** Return encrypted Kerberos ticket for service @ hostname.
  939. ** If authenp is non-NULL, also return encrypted authenticator,
  940. ** whose data should be freed by caller.
  941. ** (Originally was: Create Kerberos AP_REQ message for SSL Client.)
  942. **
  943. ** 19990628 VRS Started; Returns Kerberos AP_REQ message.
  944. ** 20010409 VRS Modified for RFC2712; Returns enc tkt.
  945. ** 20010606 VRS May also return optional authenticator.
  946. */
  947. krb5_error_code
  948. kssl_cget_tkt( /* UPDATE */ KSSL_CTX *kssl_ctx,
  949. /* OUT */ krb5_data **enc_ticketp,
  950. /* UPDATE */ krb5_data *authenp,
  951. /* OUT */ KSSL_ERR *kssl_err)
  952. {
  953. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  954. krb5_context krb5context = NULL;
  955. krb5_auth_context krb5auth_context = NULL;
  956. krb5_ccache krb5ccdef = NULL;
  957. krb5_creds krb5creds, *krb5credsp = NULL;
  958. krb5_data krb5_app_req;
  959. kssl_err_set(kssl_err, 0, "");
  960. memset((char *)&krb5creds, 0, sizeof(krb5creds));
  961. if (!kssl_ctx)
  962. {
  963. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  964. "No kssl_ctx defined.\n");
  965. goto err;
  966. }
  967. else if (!kssl_ctx->service_host)
  968. {
  969. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  970. "kssl_ctx service_host undefined.\n");
  971. goto err;
  972. }
  973. if ((krb5rc = krb5_init_context(&krb5context)) != 0)
  974. {
  975. BIO_snprintf(kssl_err->text,KSSL_ERR_MAX,
  976. "krb5_init_context() fails: %d\n", krb5rc);
  977. kssl_err->reason = SSL_R_KRB5_C_INIT;
  978. goto err;
  979. }
  980. if ((krb5rc = krb5_sname_to_principal(krb5context,
  981. kssl_ctx->service_host,
  982. (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC,
  983. KRB5_NT_SRV_HST, &krb5creds.server)) != 0)
  984. {
  985. BIO_snprintf(kssl_err->text,KSSL_ERR_MAX,
  986. "krb5_sname_to_principal() fails for %s/%s\n",
  987. kssl_ctx->service_host,
  988. (kssl_ctx->service_name)? kssl_ctx->service_name:
  989. KRB5SVC);
  990. kssl_err->reason = SSL_R_KRB5_C_INIT;
  991. goto err;
  992. }
  993. if ((krb5rc = krb5_cc_default(krb5context, &krb5ccdef)) != 0)
  994. {
  995. kssl_err_set(kssl_err, SSL_R_KRB5_C_CC_PRINC,
  996. "krb5_cc_default fails.\n");
  997. goto err;
  998. }
  999. if ((krb5rc = krb5_cc_get_principal(krb5context, krb5ccdef,
  1000. &krb5creds.client)) != 0)
  1001. {
  1002. kssl_err_set(kssl_err, SSL_R_KRB5_C_CC_PRINC,
  1003. "krb5_cc_get_principal() fails.\n");
  1004. goto err;
  1005. }
  1006. if ((krb5rc = krb5_get_credentials(krb5context, 0, krb5ccdef,
  1007. &krb5creds, &krb5credsp)) != 0)
  1008. {
  1009. kssl_err_set(kssl_err, SSL_R_KRB5_C_GET_CRED,
  1010. "krb5_get_credentials() fails.\n");
  1011. goto err;
  1012. }
  1013. *enc_ticketp = &krb5credsp->ticket;
  1014. #ifdef KRB5_HEIMDAL
  1015. kssl_ctx->enctype = krb5credsp->session.keytype;
  1016. #else
  1017. kssl_ctx->enctype = krb5credsp->keyblock.enctype;
  1018. #endif
  1019. krb5rc = KRB5KRB_ERR_GENERIC;
  1020. /* caller should free data of krb5_app_req */
  1021. /* 20010406 VRS deleted for real KerberosWrapper
  1022. ** 20010605 VRS reinstated to offer Authenticator to KerberosWrapper
  1023. */
  1024. krb5_app_req.length = 0;
  1025. if (authenp)
  1026. {
  1027. krb5_data krb5in_data;
  1028. const unsigned char *p;
  1029. long arlen;
  1030. KRB5_APREQBODY *ap_req;
  1031. authenp->length = 0;
  1032. krb5in_data.data = NULL;
  1033. krb5in_data.length = 0;
  1034. if ((krb5rc = krb5_mk_req_extended(krb5context,
  1035. &krb5auth_context, 0, &krb5in_data, krb5credsp,
  1036. &krb5_app_req)) != 0)
  1037. {
  1038. kssl_err_set(kssl_err, SSL_R_KRB5_C_MK_REQ,
  1039. "krb5_mk_req_extended() fails.\n");
  1040. goto err;
  1041. }
  1042. arlen = krb5_app_req.length;
  1043. p = (unsigned char *)krb5_app_req.data;
  1044. ap_req = (KRB5_APREQBODY *) d2i_KRB5_APREQ(NULL, &p, arlen);
  1045. if (ap_req)
  1046. {
  1047. authenp->length = i2d_KRB5_ENCDATA(
  1048. ap_req->authenticator, NULL);
  1049. if (authenp->length &&
  1050. (authenp->data = malloc(authenp->length)))
  1051. {
  1052. unsigned char *adp = (unsigned char *)authenp->data;
  1053. authenp->length = i2d_KRB5_ENCDATA(
  1054. ap_req->authenticator, &adp);
  1055. }
  1056. }
  1057. if (ap_req) KRB5_APREQ_free((KRB5_APREQ *) ap_req);
  1058. if (krb5_app_req.length)
  1059. kssl_krb5_free_data_contents(krb5context,&krb5_app_req);
  1060. }
  1061. #ifdef KRB5_HEIMDAL
  1062. if (kssl_ctx_setkey(kssl_ctx, &krb5credsp->session))
  1063. {
  1064. kssl_err_set(kssl_err, SSL_R_KRB5_C_INIT,
  1065. "kssl_ctx_setkey() fails.\n");
  1066. }
  1067. #else
  1068. if (kssl_ctx_setkey(kssl_ctx, &krb5credsp->keyblock))
  1069. {
  1070. kssl_err_set(kssl_err, SSL_R_KRB5_C_INIT,
  1071. "kssl_ctx_setkey() fails.\n");
  1072. }
  1073. #endif
  1074. else krb5rc = 0;
  1075. err:
  1076. #ifdef KSSL_DEBUG
  1077. kssl_ctx_show(kssl_ctx);
  1078. #endif /* KSSL_DEBUG */
  1079. if (krb5creds.client) krb5_free_principal(krb5context,
  1080. krb5creds.client);
  1081. if (krb5creds.server) krb5_free_principal(krb5context,
  1082. krb5creds.server);
  1083. if (krb5auth_context) krb5_auth_con_free(krb5context,
  1084. krb5auth_context);
  1085. if (krb5context) krb5_free_context(krb5context);
  1086. return (krb5rc);
  1087. }
  1088. /* Given d2i_-decoded asn1ticket, allocate and return a new krb5_ticket.
  1089. ** Return Kerberos error code and kssl_err struct on error.
  1090. ** Allocates krb5_ticket and krb5_principal; caller should free these.
  1091. **
  1092. ** 20010410 VRS Implemented krb5_decode_ticket() as
  1093. ** old_krb5_decode_ticket(). Missing from MIT1.0.6.
  1094. ** 20010615 VRS Re-cast as openssl/asn1 d2i_*() functions.
  1095. ** Re-used some of the old krb5_decode_ticket()
  1096. ** code here. This tkt should alloc/free just
  1097. ** like the real thing.
  1098. */
  1099. static krb5_error_code
  1100. kssl_TKT2tkt( /* IN */ krb5_context krb5context,
  1101. /* IN */ KRB5_TKTBODY *asn1ticket,
  1102. /* OUT */ krb5_ticket **krb5ticket,
  1103. /* OUT */ KSSL_ERR *kssl_err )
  1104. {
  1105. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  1106. krb5_ticket *new5ticket = NULL;
  1107. ASN1_GENERALSTRING *gstr_svc, *gstr_host;
  1108. *krb5ticket = NULL;
  1109. if (asn1ticket == NULL || asn1ticket->realm == NULL ||
  1110. asn1ticket->sname == NULL ||
  1111. sk_ASN1_GENERALSTRING_num(asn1ticket->sname->namestring) < 2)
  1112. {
  1113. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1114. "Null field in asn1ticket.\n");
  1115. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1116. return KRB5KRB_ERR_GENERIC;
  1117. }
  1118. if ((new5ticket = (krb5_ticket *) calloc(1, sizeof(krb5_ticket)))==NULL)
  1119. {
  1120. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1121. "Unable to allocate new krb5_ticket.\n");
  1122. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1123. return ENOMEM; /* or KRB5KRB_ERR_GENERIC; */
  1124. }
  1125. gstr_svc = sk_ASN1_GENERALSTRING_value(asn1ticket->sname->namestring, 0);
  1126. gstr_host = sk_ASN1_GENERALSTRING_value(asn1ticket->sname->namestring, 1);
  1127. if ((krb5rc = kssl_build_principal_2(krb5context,
  1128. &new5ticket->server,
  1129. asn1ticket->realm->length, (char *)asn1ticket->realm->data,
  1130. gstr_svc->length, (char *)gstr_svc->data,
  1131. gstr_host->length, (char *)gstr_host->data)) != 0)
  1132. {
  1133. free(new5ticket);
  1134. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1135. "Error building ticket server principal.\n");
  1136. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1137. return krb5rc; /* or KRB5KRB_ERR_GENERIC; */
  1138. }
  1139. krb5_princ_type(krb5context, new5ticket->server) =
  1140. asn1ticket->sname->nametype->data[0];
  1141. new5ticket->enc_part.enctype = asn1ticket->encdata->etype->data[0];
  1142. new5ticket->enc_part.kvno = asn1ticket->encdata->kvno->data[0];
  1143. new5ticket->enc_part.ciphertext.length =
  1144. asn1ticket->encdata->cipher->length;
  1145. if ((new5ticket->enc_part.ciphertext.data =
  1146. calloc(1, asn1ticket->encdata->cipher->length)) == NULL)
  1147. {
  1148. free(new5ticket);
  1149. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1150. "Error allocating cipher in krb5ticket.\n");
  1151. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1152. return KRB5KRB_ERR_GENERIC;
  1153. }
  1154. else
  1155. {
  1156. memcpy(new5ticket->enc_part.ciphertext.data,
  1157. asn1ticket->encdata->cipher->data,
  1158. asn1ticket->encdata->cipher->length);
  1159. }
  1160. *krb5ticket = new5ticket;
  1161. return 0;
  1162. }
  1163. /* Given krb5 service name in KSSL_CTX *kssl_ctx (typically "kssl"),
  1164. ** and krb5 AP_REQ message & message length,
  1165. ** Return Kerberos session key and client principle
  1166. ** to SSL Server in KSSL_CTX *kssl_ctx.
  1167. **
  1168. ** 19990702 VRS Started.
  1169. */
  1170. krb5_error_code
  1171. kssl_sget_tkt( /* UPDATE */ KSSL_CTX *kssl_ctx,
  1172. /* IN */ krb5_data *indata,
  1173. /* OUT */ krb5_ticket_times *ttimes,
  1174. /* OUT */ KSSL_ERR *kssl_err )
  1175. {
  1176. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  1177. static krb5_context krb5context = NULL;
  1178. static krb5_auth_context krb5auth_context = NULL;
  1179. krb5_ticket *krb5ticket = NULL;
  1180. KRB5_TKTBODY *asn1ticket = NULL;
  1181. const unsigned char *p;
  1182. krb5_keytab krb5keytab = NULL;
  1183. krb5_keytab_entry kt_entry;
  1184. krb5_principal krb5server;
  1185. krb5_rcache rcache = NULL;
  1186. kssl_err_set(kssl_err, 0, "");
  1187. if (!kssl_ctx)
  1188. {
  1189. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1190. "No kssl_ctx defined.\n");
  1191. goto err;
  1192. }
  1193. #ifdef KSSL_DEBUG
  1194. printf("in kssl_sget_tkt(%s)\n", kstring(kssl_ctx->service_name));
  1195. #endif /* KSSL_DEBUG */
  1196. if (!krb5context && (krb5rc = krb5_init_context(&krb5context)))
  1197. {
  1198. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1199. "krb5_init_context() fails.\n");
  1200. goto err;
  1201. }
  1202. if (krb5auth_context &&
  1203. (krb5rc = krb5_auth_con_free(krb5context, krb5auth_context)))
  1204. {
  1205. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1206. "krb5_auth_con_free() fails.\n");
  1207. goto err;
  1208. }
  1209. else krb5auth_context = NULL;
  1210. if (!krb5auth_context &&
  1211. (krb5rc = krb5_auth_con_init(krb5context, &krb5auth_context)))
  1212. {
  1213. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1214. "krb5_auth_con_init() fails.\n");
  1215. goto err;
  1216. }
  1217. if ((krb5rc = krb5_auth_con_getrcache(krb5context, krb5auth_context,
  1218. &rcache)))
  1219. {
  1220. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1221. "krb5_auth_con_getrcache() fails.\n");
  1222. goto err;
  1223. }
  1224. if ((krb5rc = krb5_sname_to_principal(krb5context, NULL,
  1225. (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC,
  1226. KRB5_NT_SRV_HST, &krb5server)) != 0)
  1227. {
  1228. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1229. "krb5_sname_to_principal() fails.\n");
  1230. goto err;
  1231. }
  1232. if (rcache == NULL)
  1233. {
  1234. if ((krb5rc = krb5_get_server_rcache(krb5context,
  1235. krb5_princ_component(krb5context, krb5server, 0),
  1236. &rcache)))
  1237. {
  1238. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1239. "krb5_get_server_rcache() fails.\n");
  1240. goto err;
  1241. }
  1242. }
  1243. if ((krb5rc = krb5_auth_con_setrcache(krb5context, krb5auth_context, rcache)))
  1244. {
  1245. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1246. "krb5_auth_con_setrcache() fails.\n");
  1247. goto err;
  1248. }
  1249. /* kssl_ctx->keytab_file == NULL ==> use Kerberos default
  1250. */
  1251. if (kssl_ctx->keytab_file)
  1252. {
  1253. krb5rc = krb5_kt_resolve(krb5context, kssl_ctx->keytab_file,
  1254. &krb5keytab);
  1255. if (krb5rc)
  1256. {
  1257. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1258. "krb5_kt_resolve() fails.\n");
  1259. goto err;
  1260. }
  1261. }
  1262. else
  1263. {
  1264. krb5rc = krb5_kt_default(krb5context,&krb5keytab);
  1265. if (krb5rc)
  1266. {
  1267. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1268. "krb5_kt_default() fails.\n");
  1269. goto err;
  1270. }
  1271. }
  1272. /* Actual Kerberos5 krb5_recvauth() has initial conversation here
  1273. ** o check KRB5_SENDAUTH_BADAUTHVERS
  1274. ** unless KRB5_RECVAUTH_SKIP_VERSION
  1275. ** o check KRB5_SENDAUTH_BADAPPLVERS
  1276. ** o send "0" msg if all OK
  1277. */
  1278. /* 20010411 was using AP_REQ instead of true KerberosWrapper
  1279. **
  1280. ** if ((krb5rc = krb5_rd_req(krb5context, &krb5auth_context,
  1281. ** &krb5in_data, krb5server, krb5keytab,
  1282. ** &ap_option, &krb5ticket)) != 0) { Error }
  1283. */
  1284. p = (unsigned char *)indata->data;
  1285. if ((asn1ticket = (KRB5_TKTBODY *) d2i_KRB5_TICKET(NULL, &p,
  1286. (long) indata->length)) == NULL)
  1287. {
  1288. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1289. "d2i_KRB5_TICKET() ASN.1 decode failure.\n");
  1290. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1291. goto err;
  1292. }
  1293. /* Was: krb5rc = krb5_decode_ticket(krb5in_data,&krb5ticket)) != 0) */
  1294. if ((krb5rc = kssl_TKT2tkt(krb5context, asn1ticket, &krb5ticket,
  1295. kssl_err)) != 0)
  1296. {
  1297. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1298. "Error converting ASN.1 ticket to krb5_ticket.\n");
  1299. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1300. goto err;
  1301. }
  1302. if (! krb5_principal_compare(krb5context, krb5server,
  1303. krb5ticket->server)) {
  1304. krb5rc = KRB5_PRINC_NOMATCH;
  1305. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1306. "server principal != ticket principal\n");
  1307. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1308. goto err;
  1309. }
  1310. if ((krb5rc = krb5_kt_get_entry(krb5context, krb5keytab,
  1311. krb5ticket->server, krb5ticket->enc_part.kvno,
  1312. krb5ticket->enc_part.enctype, &kt_entry)) != 0) {
  1313. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1314. "krb5_kt_get_entry() fails with %x.\n", krb5rc);
  1315. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1316. goto err;
  1317. }
  1318. if ((krb5rc = krb5_decrypt_tkt_part(krb5context, &kt_entry.key,
  1319. krb5ticket)) != 0) {
  1320. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1321. "krb5_decrypt_tkt_part() failed.\n");
  1322. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1323. goto err;
  1324. }
  1325. else {
  1326. krb5_kt_free_entry(krb5context, &kt_entry);
  1327. #ifdef KSSL_DEBUG
  1328. {
  1329. int i; krb5_address **paddr = krb5ticket->enc_part2->caddrs;
  1330. printf("Decrypted ticket fields:\n");
  1331. printf("\tflags: %X, transit-type: %X",
  1332. krb5ticket->enc_part2->flags,
  1333. krb5ticket->enc_part2->transited.tr_type);
  1334. print_krb5_data("\ttransit-data: ",
  1335. &(krb5ticket->enc_part2->transited.tr_contents));
  1336. printf("\tcaddrs: %p, authdata: %p\n",
  1337. krb5ticket->enc_part2->caddrs,
  1338. krb5ticket->enc_part2->authorization_data);
  1339. if (paddr)
  1340. {
  1341. printf("\tcaddrs:\n");
  1342. for (i=0; paddr[i] != NULL; i++)
  1343. {
  1344. krb5_data d;
  1345. d.length=paddr[i]->length;
  1346. d.data=paddr[i]->contents;
  1347. print_krb5_data("\t\tIP: ", &d);
  1348. }
  1349. }
  1350. printf("\tstart/auth/end times: %d / %d / %d\n",
  1351. krb5ticket->enc_part2->times.starttime,
  1352. krb5ticket->enc_part2->times.authtime,
  1353. krb5ticket->enc_part2->times.endtime);
  1354. }
  1355. #endif /* KSSL_DEBUG */
  1356. }
  1357. krb5rc = KRB5_NO_TKT_SUPPLIED;
  1358. if (!krb5ticket || !krb5ticket->enc_part2 ||
  1359. !krb5ticket->enc_part2->client ||
  1360. !krb5ticket->enc_part2->client->data ||
  1361. !krb5ticket->enc_part2->session)
  1362. {
  1363. kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
  1364. "bad ticket from krb5_rd_req.\n");
  1365. }
  1366. else if (kssl_ctx_setprinc(kssl_ctx, KSSL_CLIENT,
  1367. &krb5ticket->enc_part2->client->realm,
  1368. krb5ticket->enc_part2->client->data,
  1369. krb5ticket->enc_part2->client->length))
  1370. {
  1371. kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
  1372. "kssl_ctx_setprinc() fails.\n");
  1373. }
  1374. else if (kssl_ctx_setkey(kssl_ctx, krb5ticket->enc_part2->session))
  1375. {
  1376. kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
  1377. "kssl_ctx_setkey() fails.\n");
  1378. }
  1379. else if (krb5ticket->enc_part2->flags & TKT_FLG_INVALID)
  1380. {
  1381. krb5rc = KRB5KRB_AP_ERR_TKT_INVALID;
  1382. kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
  1383. "invalid ticket from krb5_rd_req.\n");
  1384. }
  1385. else krb5rc = 0;
  1386. kssl_ctx->enctype = krb5ticket->enc_part.enctype;
  1387. ttimes->authtime = krb5ticket->enc_part2->times.authtime;
  1388. ttimes->starttime = krb5ticket->enc_part2->times.starttime;
  1389. ttimes->endtime = krb5ticket->enc_part2->times.endtime;
  1390. ttimes->renew_till = krb5ticket->enc_part2->times.renew_till;
  1391. err:
  1392. #ifdef KSSL_DEBUG
  1393. kssl_ctx_show(kssl_ctx);
  1394. #endif /* KSSL_DEBUG */
  1395. if (asn1ticket) KRB5_TICKET_free((KRB5_TICKET *) asn1ticket);
  1396. if (krb5keytab) krb5_kt_close(krb5context, krb5keytab);
  1397. if (krb5ticket) krb5_free_ticket(krb5context, krb5ticket);
  1398. if (krb5server) krb5_free_principal(krb5context, krb5server);
  1399. return (krb5rc);
  1400. }
  1401. /* Allocate & return a new kssl_ctx struct.
  1402. */
  1403. KSSL_CTX *
  1404. kssl_ctx_new(void)
  1405. {
  1406. return ((KSSL_CTX *) kssl_calloc(1, sizeof(KSSL_CTX)));
  1407. }
  1408. /* Frees a kssl_ctx struct and any allocated memory it holds.
  1409. ** Returns NULL.
  1410. */
  1411. KSSL_CTX *
  1412. kssl_ctx_free(KSSL_CTX *kssl_ctx)
  1413. {
  1414. if (kssl_ctx == NULL) return kssl_ctx;
  1415. if (kssl_ctx->key) OPENSSL_cleanse(kssl_ctx->key,
  1416. kssl_ctx->length);
  1417. if (kssl_ctx->key) kssl_free(kssl_ctx->key);
  1418. if (kssl_ctx->client_princ) kssl_free(kssl_ctx->client_princ);
  1419. if (kssl_ctx->service_host) kssl_free(kssl_ctx->service_host);
  1420. if (kssl_ctx->service_name) kssl_free(kssl_ctx->service_name);
  1421. if (kssl_ctx->keytab_file) kssl_free(kssl_ctx->keytab_file);
  1422. kssl_free(kssl_ctx);
  1423. return (KSSL_CTX *) NULL;
  1424. }
  1425. /* Given an array of (krb5_data *) entity (and optional realm),
  1426. ** set the plain (char *) client_princ or service_host member
  1427. ** of the kssl_ctx struct.
  1428. */
  1429. krb5_error_code
  1430. kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,
  1431. krb5_data *realm, krb5_data *entity, int nentities)
  1432. {
  1433. char **princ;
  1434. int length;
  1435. int i;
  1436. if (kssl_ctx == NULL || entity == NULL) return KSSL_CTX_ERR;
  1437. switch (which)
  1438. {
  1439. case KSSL_CLIENT: princ = &kssl_ctx->client_princ; break;
  1440. case KSSL_SERVER: princ = &kssl_ctx->service_host; break;
  1441. default: return KSSL_CTX_ERR; break;
  1442. }
  1443. if (*princ) kssl_free(*princ);
  1444. /* Add up all the entity->lengths */
  1445. length = 0;
  1446. for (i=0; i < nentities; i++)
  1447. {
  1448. length += entity[i].length;
  1449. }
  1450. /* Add in space for the '/' character(s) (if any) */
  1451. length += nentities-1;
  1452. /* Space for the ('@'+realm+NULL | NULL) */
  1453. length += ((realm)? realm->length + 2: 1);
  1454. if ((*princ = kssl_calloc(1, length)) == NULL)
  1455. return KSSL_CTX_ERR;
  1456. else
  1457. {
  1458. for (i = 0; i < nentities; i++)
  1459. {
  1460. strncat(*princ, entity[i].data, entity[i].length);
  1461. if (i < nentities-1)
  1462. {
  1463. strcat (*princ, "/");
  1464. }
  1465. }
  1466. if (realm)
  1467. {
  1468. strcat (*princ, "@");
  1469. (void) strncat(*princ, realm->data, realm->length);
  1470. }
  1471. }
  1472. return KSSL_CTX_OK;
  1473. }
  1474. /* Set one of the plain (char *) string members of the kssl_ctx struct.
  1475. ** Default values should be:
  1476. ** which == KSSL_SERVICE => "khost" (KRB5SVC)
  1477. ** which == KSSL_KEYTAB => "/etc/krb5.keytab" (KRB5KEYTAB)
  1478. */
  1479. krb5_error_code
  1480. kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text)
  1481. {
  1482. char **string;
  1483. if (!kssl_ctx) return KSSL_CTX_ERR;
  1484. switch (which)
  1485. {
  1486. case KSSL_SERVICE: string = &kssl_ctx->service_name; break;
  1487. case KSSL_SERVER: string = &kssl_ctx->service_host; break;
  1488. case KSSL_CLIENT: string = &kssl_ctx->client_princ; break;
  1489. case KSSL_KEYTAB: string = &kssl_ctx->keytab_file; break;
  1490. default: return KSSL_CTX_ERR; break;
  1491. }
  1492. if (*string) kssl_free(*string);
  1493. if (!text)
  1494. {
  1495. *string = '\0';
  1496. return KSSL_CTX_OK;
  1497. }
  1498. if ((*string = kssl_calloc(1, strlen(text) + 1)) == NULL)
  1499. return KSSL_CTX_ERR;
  1500. else
  1501. strcpy(*string, text);
  1502. return KSSL_CTX_OK;
  1503. }
  1504. /* Copy the Kerberos session key from a (krb5_keyblock *) to a kssl_ctx
  1505. ** struct. Clear kssl_ctx->key if Kerberos session key is NULL.
  1506. */
  1507. krb5_error_code
  1508. kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session)
  1509. {
  1510. int length;
  1511. krb5_enctype enctype;
  1512. krb5_octet FAR *contents = NULL;
  1513. if (!kssl_ctx) return KSSL_CTX_ERR;
  1514. if (kssl_ctx->key)
  1515. {
  1516. OPENSSL_cleanse(kssl_ctx->key, kssl_ctx->length);
  1517. kssl_free(kssl_ctx->key);
  1518. }
  1519. if (session)
  1520. {
  1521. #ifdef KRB5_HEIMDAL
  1522. length = session->keyvalue->length;
  1523. enctype = session->keytype;
  1524. contents = session->keyvalue->contents;
  1525. #else
  1526. length = session->length;
  1527. enctype = session->enctype;
  1528. contents = session->contents;
  1529. #endif
  1530. kssl_ctx->enctype = enctype;
  1531. kssl_ctx->length = length;
  1532. }
  1533. else
  1534. {
  1535. kssl_ctx->enctype = ENCTYPE_UNKNOWN;
  1536. kssl_ctx->length = 0;
  1537. return KSSL_CTX_OK;
  1538. }
  1539. if ((kssl_ctx->key =
  1540. (krb5_octet FAR *) kssl_calloc(1, kssl_ctx->length)) == NULL)
  1541. {
  1542. kssl_ctx->length = 0;
  1543. return KSSL_CTX_ERR;
  1544. }
  1545. else
  1546. memcpy(kssl_ctx->key, contents, length);
  1547. return KSSL_CTX_OK;
  1548. }
  1549. /* Display contents of kssl_ctx struct
  1550. */
  1551. void
  1552. kssl_ctx_show(KSSL_CTX *kssl_ctx)
  1553. {
  1554. int i;
  1555. printf("kssl_ctx: ");
  1556. if (kssl_ctx == NULL)
  1557. {
  1558. printf("NULL\n");
  1559. return;
  1560. }
  1561. else
  1562. printf("%p\n", (void *)kssl_ctx);
  1563. printf("\tservice:\t%s\n",
  1564. (kssl_ctx->service_name)? kssl_ctx->service_name: "NULL");
  1565. printf("\tclient:\t%s\n",
  1566. (kssl_ctx->client_princ)? kssl_ctx->client_princ: "NULL");
  1567. printf("\tserver:\t%s\n",
  1568. (kssl_ctx->service_host)? kssl_ctx->service_host: "NULL");
  1569. printf("\tkeytab:\t%s\n",
  1570. (kssl_ctx->keytab_file)? kssl_ctx->keytab_file: "NULL");
  1571. printf("\tkey [%d:%d]:\t",
  1572. kssl_ctx->enctype, kssl_ctx->length);
  1573. for (i=0; i < kssl_ctx->length && kssl_ctx->key; i++)
  1574. {
  1575. printf("%02x", kssl_ctx->key[i]);
  1576. }
  1577. printf("\n");
  1578. return;
  1579. }
  1580. int
  1581. kssl_keytab_is_available(KSSL_CTX *kssl_ctx)
  1582. {
  1583. krb5_context krb5context = NULL;
  1584. krb5_keytab krb5keytab = NULL;
  1585. krb5_keytab_entry entry;
  1586. krb5_principal princ = NULL;
  1587. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  1588. int rc = 0;
  1589. if ((krb5rc = krb5_init_context(&krb5context)))
  1590. return(0);
  1591. /* kssl_ctx->keytab_file == NULL ==> use Kerberos default
  1592. */
  1593. if (kssl_ctx->keytab_file)
  1594. {
  1595. krb5rc = krb5_kt_resolve(krb5context, kssl_ctx->keytab_file,
  1596. &krb5keytab);
  1597. if (krb5rc)
  1598. goto exit;
  1599. }
  1600. else
  1601. {
  1602. krb5rc = krb5_kt_default(krb5context,&krb5keytab);
  1603. if (krb5rc)
  1604. goto exit;
  1605. }
  1606. /* the host key we are looking for */
  1607. krb5rc = krb5_sname_to_principal(krb5context, NULL,
  1608. kssl_ctx->service_name ? kssl_ctx->service_name: KRB5SVC,
  1609. KRB5_NT_SRV_HST, &princ);
  1610. if (krb5rc)
  1611. goto exit;
  1612. krb5rc = krb5_kt_get_entry(krb5context, krb5keytab,
  1613. princ,
  1614. 0 /* IGNORE_VNO */,
  1615. 0 /* IGNORE_ENCTYPE */,
  1616. &entry);
  1617. if ( krb5rc == KRB5_KT_NOTFOUND ) {
  1618. rc = 1;
  1619. goto exit;
  1620. } else if ( krb5rc )
  1621. goto exit;
  1622. krb5_kt_free_entry(krb5context, &entry);
  1623. rc = 1;
  1624. exit:
  1625. if (krb5keytab) krb5_kt_close(krb5context, krb5keytab);
  1626. if (princ) krb5_free_principal(krb5context, princ);
  1627. if (krb5context) krb5_free_context(krb5context);
  1628. return(rc);
  1629. }
  1630. int
  1631. kssl_tgt_is_available(KSSL_CTX *kssl_ctx)
  1632. {
  1633. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  1634. krb5_context krb5context = NULL;
  1635. krb5_ccache krb5ccdef = NULL;
  1636. krb5_creds krb5creds, *krb5credsp = NULL;
  1637. int rc = 0;
  1638. memset((char *)&krb5creds, 0, sizeof(krb5creds));
  1639. if (!kssl_ctx)
  1640. return(0);
  1641. if (!kssl_ctx->service_host)
  1642. return(0);
  1643. if ((krb5rc = krb5_init_context(&krb5context)) != 0)
  1644. goto err;
  1645. if ((krb5rc = krb5_sname_to_principal(krb5context,
  1646. kssl_ctx->service_host,
  1647. (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC,
  1648. KRB5_NT_SRV_HST, &krb5creds.server)) != 0)
  1649. goto err;
  1650. if ((krb5rc = krb5_cc_default(krb5context, &krb5ccdef)) != 0)
  1651. goto err;
  1652. if ((krb5rc = krb5_cc_get_principal(krb5context, krb5ccdef,
  1653. &krb5creds.client)) != 0)
  1654. goto err;
  1655. if ((krb5rc = krb5_get_credentials(krb5context, 0, krb5ccdef,
  1656. &krb5creds, &krb5credsp)) != 0)
  1657. goto err;
  1658. rc = 1;
  1659. err:
  1660. #ifdef KSSL_DEBUG
  1661. kssl_ctx_show(kssl_ctx);
  1662. #endif /* KSSL_DEBUG */
  1663. if (krb5creds.client) krb5_free_principal(krb5context, krb5creds.client);
  1664. if (krb5creds.server) krb5_free_principal(krb5context, krb5creds.server);
  1665. if (krb5context) krb5_free_context(krb5context);
  1666. return(rc);
  1667. }
  1668. #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_WIN32)
  1669. void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data)
  1670. {
  1671. #ifdef KRB5_HEIMDAL
  1672. data->length = 0;
  1673. if (data->data)
  1674. free(data->data);
  1675. #elif defined(KRB5_MIT_OLD11)
  1676. if (data->data) {
  1677. krb5_xfree(data->data);
  1678. data->data = 0;
  1679. }
  1680. #else
  1681. krb5_free_data_contents(NULL, data);
  1682. #endif
  1683. }
  1684. #endif /* !OPENSSL_SYS_WINDOWS && !OPENSSL_SYS_WIN32 */
  1685. /* Given pointers to KerberosTime and struct tm structs, convert the
  1686. ** KerberosTime string to struct tm. Note that KerberosTime is a
  1687. ** ASN1_GENERALIZEDTIME value, constrained to GMT with no fractional
  1688. ** seconds as defined in RFC 1510.
  1689. ** Return pointer to the (partially) filled in struct tm on success,
  1690. ** return NULL on failure.
  1691. */
  1692. static struct tm *k_gmtime(ASN1_GENERALIZEDTIME *gtime, struct tm *k_tm)
  1693. {
  1694. char c, *p;
  1695. if (!k_tm) return NULL;
  1696. if (gtime == NULL || gtime->length < 14) return NULL;
  1697. if (gtime->data == NULL) return NULL;
  1698. p = (char *)&gtime->data[14];
  1699. c = *p; *p = '\0'; p -= 2; k_tm->tm_sec = atoi(p); *(p+2) = c;
  1700. c = *p; *p = '\0'; p -= 2; k_tm->tm_min = atoi(p); *(p+2) = c;
  1701. c = *p; *p = '\0'; p -= 2; k_tm->tm_hour = atoi(p); *(p+2) = c;
  1702. c = *p; *p = '\0'; p -= 2; k_tm->tm_mday = atoi(p); *(p+2) = c;
  1703. c = *p; *p = '\0'; p -= 2; k_tm->tm_mon = atoi(p)-1; *(p+2) = c;
  1704. c = *p; *p = '\0'; p -= 4; k_tm->tm_year = atoi(p)-1900; *(p+4) = c;
  1705. return k_tm;
  1706. }
  1707. /* Helper function for kssl_validate_times().
  1708. ** We need context->clockskew, but krb5_context is an opaque struct.
  1709. ** So we try to sneek the clockskew out through the replay cache.
  1710. ** If that fails just return a likely default (300 seconds).
  1711. */
  1712. static krb5_deltat get_rc_clockskew(krb5_context context)
  1713. {
  1714. krb5_rcache rc;
  1715. krb5_deltat clockskew;
  1716. if (krb5_rc_default(context, &rc)) return KSSL_CLOCKSKEW;
  1717. if (krb5_rc_initialize(context, rc, 0)) return KSSL_CLOCKSKEW;
  1718. if (krb5_rc_get_lifespan(context, rc, &clockskew)) {
  1719. clockskew = KSSL_CLOCKSKEW;
  1720. }
  1721. (void) krb5_rc_destroy(context, rc);
  1722. return clockskew;
  1723. }
  1724. /* kssl_validate_times() combines (and more importantly exposes)
  1725. ** the MIT KRB5 internal function krb5_validate_times() and the
  1726. ** in_clock_skew() macro. The authenticator client time is checked
  1727. ** to be within clockskew secs of the current time and the current
  1728. ** time is checked to be within the ticket start and expire times.
  1729. ** Either check may be omitted by supplying a NULL value.
  1730. ** Returns 0 for valid times, SSL_R_KRB5* error codes otherwise.
  1731. ** See Also: (Kerberos source)/krb5/lib/krb5/krb/valid_times.c
  1732. ** 20010420 VRS
  1733. */
  1734. krb5_error_code kssl_validate_times( krb5_timestamp atime,
  1735. krb5_ticket_times *ttimes)
  1736. {
  1737. krb5_deltat skew;
  1738. krb5_timestamp start, now;
  1739. krb5_error_code rc;
  1740. krb5_context context;
  1741. if ((rc = krb5_init_context(&context))) return SSL_R_KRB5_S_BAD_TICKET;
  1742. skew = get_rc_clockskew(context);
  1743. if ((rc = krb5_timeofday(context,&now))) return SSL_R_KRB5_S_BAD_TICKET;
  1744. krb5_free_context(context);
  1745. if (atime && labs(atime - now) >= skew) return SSL_R_KRB5_S_TKT_SKEW;
  1746. if (! ttimes) return 0;
  1747. start = (ttimes->starttime != 0)? ttimes->starttime: ttimes->authtime;
  1748. if (start - now > skew) return SSL_R_KRB5_S_TKT_NYV;
  1749. if ((now - ttimes->endtime) > skew) return SSL_R_KRB5_S_TKT_EXPIRED;
  1750. #ifdef KSSL_DEBUG
  1751. printf("kssl_validate_times: %d |<- | %d - %d | < %d ->| %d\n",
  1752. start, atime, now, skew, ttimes->endtime);
  1753. #endif /* KSSL_DEBUG */
  1754. return 0;
  1755. }
  1756. /* Decode and decrypt given DER-encoded authenticator, then pass
  1757. ** authenticator ctime back in *atimep (or 0 if time unavailable).
  1758. ** Returns krb5_error_code and kssl_err on error. A NULL
  1759. ** authenticator (authentp->length == 0) is not considered an error.
  1760. ** Note that kssl_check_authent() makes use of the KRB5 session key;
  1761. ** you must call kssl_sget_tkt() to get the key before calling this routine.
  1762. */
  1763. krb5_error_code kssl_check_authent(
  1764. /* IN */ KSSL_CTX *kssl_ctx,
  1765. /* IN */ krb5_data *authentp,
  1766. /* OUT */ krb5_timestamp *atimep,
  1767. /* OUT */ KSSL_ERR *kssl_err )
  1768. {
  1769. krb5_error_code krb5rc = 0;
  1770. KRB5_ENCDATA *dec_authent = NULL;
  1771. KRB5_AUTHENTBODY *auth = NULL;
  1772. krb5_enctype enctype;
  1773. EVP_CIPHER_CTX ciph_ctx;
  1774. const EVP_CIPHER *enc = NULL;
  1775. unsigned char iv[EVP_MAX_IV_LENGTH];
  1776. const unsigned char *p;
  1777. unsigned char *unenc_authent;
  1778. int outl, unencbufsize;
  1779. struct tm tm_time, *tm_l, *tm_g;
  1780. time_t now, tl, tg, tr, tz_offset;
  1781. EVP_CIPHER_CTX_init(&ciph_ctx);
  1782. *atimep = 0;
  1783. kssl_err_set(kssl_err, 0, "");
  1784. #ifndef KRB5CHECKAUTH
  1785. authentp = NULL;
  1786. #else
  1787. #if KRB5CHECKAUTH == 0
  1788. authentp = NULL;
  1789. #endif
  1790. #endif /* KRB5CHECKAUTH */
  1791. if (authentp == NULL || authentp->length == 0) return 0;
  1792. #ifdef KSSL_DEBUG
  1793. {
  1794. unsigned int ui;
  1795. printf("kssl_check_authent: authenticator[%d]:\n",authentp->length);
  1796. p = authentp->data;
  1797. for (ui=0; ui < authentp->length; ui++) printf("%02x ",p[ui]);
  1798. printf("\n");
  1799. }
  1800. #endif /* KSSL_DEBUG */
  1801. unencbufsize = 2 * authentp->length;
  1802. if ((unenc_authent = calloc(1, unencbufsize)) == NULL)
  1803. {
  1804. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1805. "Unable to allocate authenticator buffer.\n");
  1806. krb5rc = KRB5KRB_ERR_GENERIC;
  1807. goto err;
  1808. }
  1809. p = (unsigned char *)authentp->data;
  1810. if ((dec_authent = d2i_KRB5_ENCDATA(NULL, &p,
  1811. (long) authentp->length)) == NULL)
  1812. {
  1813. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1814. "Error decoding authenticator.\n");
  1815. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1816. goto err;
  1817. }
  1818. enctype = dec_authent->etype->data[0]; /* should = kssl_ctx->enctype */
  1819. #if !defined(KRB5_MIT_OLD11)
  1820. switch ( enctype ) {
  1821. case ENCTYPE_DES3_CBC_SHA1: /* EVP_des_ede3_cbc(); */
  1822. case ENCTYPE_DES3_CBC_SHA:
  1823. case ENCTYPE_DES3_CBC_RAW:
  1824. krb5rc = 0; /* Skip, can't handle derived keys */
  1825. goto err;
  1826. }
  1827. #endif
  1828. enc = kssl_map_enc(enctype);
  1829. memset(iv, 0, sizeof iv); /* per RFC 1510 */
  1830. if (enc == NULL)
  1831. {
  1832. /* Disable kssl_check_authent for ENCTYPE_DES3_CBC_SHA1.
  1833. ** This enctype indicates the authenticator was encrypted
  1834. ** using key-usage derived keys which openssl cannot decrypt.
  1835. */
  1836. goto err;
  1837. }
  1838. if (!EVP_CipherInit(&ciph_ctx,enc,kssl_ctx->key,iv,0))
  1839. {
  1840. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1841. "EVP_CipherInit error decrypting authenticator.\n");
  1842. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1843. goto err;
  1844. }
  1845. outl = dec_authent->cipher->length;
  1846. if (!EVP_Cipher(&ciph_ctx,unenc_authent,dec_authent->cipher->data,outl))
  1847. {
  1848. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1849. "EVP_Cipher error decrypting authenticator.\n");
  1850. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1851. goto err;
  1852. }
  1853. EVP_CIPHER_CTX_cleanup(&ciph_ctx);
  1854. #ifdef KSSL_DEBUG
  1855. printf("kssl_check_authent: decrypted authenticator[%d] =\n", outl);
  1856. for (padl=0; padl < outl; padl++) printf("%02x ",unenc_authent[padl]);
  1857. printf("\n");
  1858. #endif /* KSSL_DEBUG */
  1859. if ((p = kssl_skip_confound(enctype, unenc_authent)) == NULL)
  1860. {
  1861. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1862. "confounded by authenticator.\n");
  1863. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1864. goto err;
  1865. }
  1866. outl -= p - unenc_authent;
  1867. if ((auth = (KRB5_AUTHENTBODY *) d2i_KRB5_AUTHENT(NULL, &p,
  1868. (long) outl))==NULL)
  1869. {
  1870. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1871. "Error decoding authenticator body.\n");
  1872. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1873. goto err;
  1874. }
  1875. memset(&tm_time,0,sizeof(struct tm));
  1876. if (k_gmtime(auth->ctime, &tm_time) &&
  1877. ((tr = mktime(&tm_time)) != (time_t)(-1)))
  1878. {
  1879. now = time(&now);
  1880. tm_l = localtime(&now); tl = mktime(tm_l);
  1881. tm_g = gmtime(&now); tg = mktime(tm_g);
  1882. tz_offset = tg - tl;
  1883. *atimep = (krb5_timestamp)(tr - tz_offset);
  1884. }
  1885. #ifdef KSSL_DEBUG
  1886. printf("kssl_check_authent: returns %d for client time ", *atimep);
  1887. if (auth && auth->ctime && auth->ctime->length && auth->ctime->data)
  1888. printf("%.*s\n", auth->ctime->length, auth->ctime->data);
  1889. else printf("NULL\n");
  1890. #endif /* KSSL_DEBUG */
  1891. err:
  1892. if (auth) KRB5_AUTHENT_free((KRB5_AUTHENT *) auth);
  1893. if (dec_authent) KRB5_ENCDATA_free(dec_authent);
  1894. if (unenc_authent) free(unenc_authent);
  1895. EVP_CIPHER_CTX_cleanup(&ciph_ctx);
  1896. return krb5rc;
  1897. }
  1898. /* Replaces krb5_build_principal_ext(), with varargs length == 2 (svc, host),
  1899. ** because I dont't know how to stub varargs.
  1900. ** Returns krb5_error_code == ENOMEM on alloc error, otherwise
  1901. ** passes back newly constructed principal, which should be freed by caller.
  1902. */
  1903. krb5_error_code kssl_build_principal_2(
  1904. /* UPDATE */ krb5_context context,
  1905. /* OUT */ krb5_principal *princ,
  1906. /* IN */ int rlen, const char *realm,
  1907. /* IN */ int slen, const char *svc,
  1908. /* IN */ int hlen, const char *host)
  1909. {
  1910. krb5_data *p_data = NULL;
  1911. krb5_principal new_p = NULL;
  1912. char *new_r = NULL;
  1913. if ((p_data = (krb5_data *) calloc(2, sizeof(krb5_data))) == NULL ||
  1914. (new_p = (krb5_principal) calloc(1, sizeof(krb5_principal_data)))
  1915. == NULL) goto err;
  1916. new_p->length = 2;
  1917. new_p->data = p_data;
  1918. if ((new_r = calloc(1, rlen + 1)) == NULL) goto err;
  1919. memcpy(new_r, realm, rlen);
  1920. krb5_princ_set_realm_length(context, new_p, rlen);
  1921. krb5_princ_set_realm_data(context, new_p, new_r);
  1922. if ((new_p->data[0].data = calloc(1, slen + 1)) == NULL) goto err;
  1923. memcpy(new_p->data[0].data, svc, slen);
  1924. new_p->data[0].length = slen;
  1925. if ((new_p->data[1].data = calloc(1, hlen + 1)) == NULL) goto err;
  1926. memcpy(new_p->data[1].data, host, hlen);
  1927. new_p->data[1].length = hlen;
  1928. krb5_princ_type(context, new_p) = KRB5_NT_UNKNOWN;
  1929. *princ = new_p;
  1930. return 0;
  1931. err:
  1932. if (new_p && new_p[0].data) free(new_p[0].data);
  1933. if (new_p && new_p[1].data) free(new_p[1].data);
  1934. if (new_p) free(new_p);
  1935. if (new_r) free(new_r);
  1936. return ENOMEM;
  1937. }
  1938. void SSL_set0_kssl_ctx(SSL *s, KSSL_CTX *kctx)
  1939. {
  1940. s->kssl_ctx = kctx;
  1941. }
  1942. KSSL_CTX * SSL_get0_kssl_ctx(SSL *s)
  1943. {
  1944. return s->kssl_ctx;
  1945. }
  1946. char *kssl_ctx_get0_client_princ(KSSL_CTX *kctx)
  1947. {
  1948. if (kctx)
  1949. return kctx->client_princ;
  1950. return NULL;
  1951. }
  1952. #else /* !OPENSSL_NO_KRB5 */
  1953. #if defined(PEDANTIC) || defined(OPENSSL_SYS_VMS)
  1954. static void *dummy=&dummy;
  1955. #endif
  1956. #endif /* !OPENSSL_NO_KRB5 */