kssl.c 68 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202
  1. /* ssl/kssl.c -*- mode: C; c-file-style: "eay" -*- */
  2. /* Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project 2000.
  3. */
  4. /* ====================================================================
  5. * Copyright (c) 2000 The OpenSSL Project. All rights reserved.
  6. *
  7. * Redistribution and use in source and binary forms, with or without
  8. * modification, are permitted provided that the following conditions
  9. * are met:
  10. *
  11. * 1. Redistributions of source code must retain the above copyright
  12. * notice, this list of conditions and the following disclaimer.
  13. *
  14. * 2. Redistributions in binary form must reproduce the above copyright
  15. * notice, this list of conditions and the following disclaimer in
  16. * the documentation and/or other materials provided with the
  17. * distribution.
  18. *
  19. * 3. All advertising materials mentioning features or use of this
  20. * software must display the following acknowledgment:
  21. * "This product includes software developed by the OpenSSL Project
  22. * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
  23. *
  24. * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
  25. * endorse or promote products derived from this software without
  26. * prior written permission. For written permission, please contact
  27. * licensing@OpenSSL.org.
  28. *
  29. * 5. Products derived from this software may not be called "OpenSSL"
  30. * nor may "OpenSSL" appear in their names without prior written
  31. * permission of the OpenSSL Project.
  32. *
  33. * 6. Redistributions of any form whatsoever must retain the following
  34. * acknowledgment:
  35. * "This product includes software developed by the OpenSSL Project
  36. * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
  37. *
  38. * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
  39. * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  40. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  41. * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
  42. * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  43. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  44. * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  45. * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  46. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  47. * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  48. * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
  49. * OF THE POSSIBILITY OF SUCH DAMAGE.
  50. * ====================================================================
  51. *
  52. * This product includes cryptographic software written by Eric Young
  53. * (eay@cryptsoft.com). This product includes software written by Tim
  54. * Hudson (tjh@cryptsoft.com).
  55. *
  56. */
  57. /* ssl/kssl.c -- Routines to support (& debug) Kerberos5 auth for openssl
  58. **
  59. ** 19990701 VRS Started.
  60. ** 200011?? Jeffrey Altman, Richard Levitte
  61. ** Generalized for Heimdal, Newer MIT, & Win32.
  62. ** Integrated into main OpenSSL 0.9.7 snapshots.
  63. ** 20010413 Simon Wilkinson, VRS
  64. ** Real RFC2712 KerberosWrapper replaces AP_REQ.
  65. */
  66. #include <openssl/opensslconf.h>
  67. #include <string.h>
  68. #define KRB5_PRIVATE 1
  69. #include <openssl/ssl.h>
  70. #include <openssl/evp.h>
  71. #include <openssl/objects.h>
  72. #include <openssl/krb5_asn.h>
  73. #include "kssl_lcl.h"
  74. #ifndef OPENSSL_NO_KRB5
  75. #ifndef ENOMEM
  76. #define ENOMEM KRB5KRB_ERR_GENERIC
  77. #endif
  78. /*
  79. * When OpenSSL is built on Windows, we do not want to require that
  80. * the Kerberos DLLs be available in order for the OpenSSL DLLs to
  81. * work. Therefore, all Kerberos routines are loaded at run time
  82. * and we do not link to a .LIB file.
  83. */
  84. #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_WIN32)
  85. /*
  86. * The purpose of the following pre-processor statements is to provide
  87. * compatibility with different releases of MIT Kerberos for Windows.
  88. * All versions up to 1.2 used macros. But macros do not allow for
  89. * a binary compatible interface for DLLs. Therefore, all macros are
  90. * being replaced by function calls. The following code will allow
  91. * an OpenSSL DLL built on Windows to work whether or not the macro
  92. * or function form of the routines are utilized.
  93. */
  94. #ifdef krb5_cc_get_principal
  95. #define NO_DEF_KRB5_CCACHE
  96. #undef krb5_cc_get_principal
  97. #endif
  98. #define krb5_cc_get_principal kssl_krb5_cc_get_principal
  99. #define krb5_free_data_contents kssl_krb5_free_data_contents
  100. #define krb5_free_context kssl_krb5_free_context
  101. #define krb5_auth_con_free kssl_krb5_auth_con_free
  102. #define krb5_free_principal kssl_krb5_free_principal
  103. #define krb5_mk_req_extended kssl_krb5_mk_req_extended
  104. #define krb5_get_credentials kssl_krb5_get_credentials
  105. #define krb5_cc_default kssl_krb5_cc_default
  106. #define krb5_sname_to_principal kssl_krb5_sname_to_principal
  107. #define krb5_init_context kssl_krb5_init_context
  108. #define krb5_free_ticket kssl_krb5_free_ticket
  109. #define krb5_rd_req kssl_krb5_rd_req
  110. #define krb5_kt_default kssl_krb5_kt_default
  111. #define krb5_kt_resolve kssl_krb5_kt_resolve
  112. /* macros in mit 1.2.2 and earlier; functions in mit 1.2.3 and greater */
  113. #ifndef krb5_kt_close
  114. #define krb5_kt_close kssl_krb5_kt_close
  115. #endif /* krb5_kt_close */
  116. #ifndef krb5_kt_get_entry
  117. #define krb5_kt_get_entry kssl_krb5_kt_get_entry
  118. #endif /* krb5_kt_get_entry */
  119. #define krb5_auth_con_init kssl_krb5_auth_con_init
  120. #define krb5_principal_compare kssl_krb5_principal_compare
  121. #define krb5_decrypt_tkt_part kssl_krb5_decrypt_tkt_part
  122. #define krb5_timeofday kssl_krb5_timeofday
  123. #define krb5_rc_default kssl_krb5_rc_default
  124. #ifdef krb5_rc_initialize
  125. #undef krb5_rc_initialize
  126. #endif
  127. #define krb5_rc_initialize kssl_krb5_rc_initialize
  128. #ifdef krb5_rc_get_lifespan
  129. #undef krb5_rc_get_lifespan
  130. #endif
  131. #define krb5_rc_get_lifespan kssl_krb5_rc_get_lifespan
  132. #ifdef krb5_rc_destroy
  133. #undef krb5_rc_destroy
  134. #endif
  135. #define krb5_rc_destroy kssl_krb5_rc_destroy
  136. #define valid_cksumtype kssl_valid_cksumtype
  137. #define krb5_checksum_size kssl_krb5_checksum_size
  138. #define krb5_kt_free_entry kssl_krb5_kt_free_entry
  139. #define krb5_auth_con_setrcache kssl_krb5_auth_con_setrcache
  140. #define krb5_auth_con_getrcache kssl_krb5_auth_con_getrcache
  141. #define krb5_get_server_rcache kssl_krb5_get_server_rcache
  142. /* Prototypes for built in stubs */
  143. void kssl_krb5_free_data_contents(krb5_context, krb5_data *);
  144. void kssl_krb5_free_principal(krb5_context, krb5_principal );
  145. krb5_error_code kssl_krb5_kt_resolve(krb5_context,
  146. krb5_const char *,
  147. krb5_keytab *);
  148. krb5_error_code kssl_krb5_kt_default(krb5_context,
  149. krb5_keytab *);
  150. krb5_error_code kssl_krb5_free_ticket(krb5_context, krb5_ticket *);
  151. krb5_error_code kssl_krb5_rd_req(krb5_context, krb5_auth_context *,
  152. krb5_const krb5_data *,
  153. krb5_const_principal, krb5_keytab,
  154. krb5_flags *,krb5_ticket **);
  155. krb5_boolean kssl_krb5_principal_compare(krb5_context, krb5_const_principal,
  156. krb5_const_principal);
  157. krb5_error_code kssl_krb5_mk_req_extended(krb5_context,
  158. krb5_auth_context *,
  159. krb5_const krb5_flags,
  160. krb5_data *,
  161. krb5_creds *,
  162. krb5_data * );
  163. krb5_error_code kssl_krb5_init_context(krb5_context *);
  164. void kssl_krb5_free_context(krb5_context);
  165. krb5_error_code kssl_krb5_cc_default(krb5_context,krb5_ccache *);
  166. krb5_error_code kssl_krb5_sname_to_principal(krb5_context,
  167. krb5_const char *,
  168. krb5_const char *,
  169. krb5_int32,
  170. krb5_principal *);
  171. krb5_error_code kssl_krb5_get_credentials(krb5_context,
  172. krb5_const krb5_flags,
  173. krb5_ccache,
  174. krb5_creds *,
  175. krb5_creds * *);
  176. krb5_error_code kssl_krb5_auth_con_init(krb5_context,
  177. krb5_auth_context *);
  178. krb5_error_code kssl_krb5_cc_get_principal(krb5_context context,
  179. krb5_ccache cache,
  180. krb5_principal *principal);
  181. krb5_error_code kssl_krb5_auth_con_free(krb5_context,krb5_auth_context);
  182. size_t kssl_krb5_checksum_size(krb5_context context,krb5_cksumtype ctype);
  183. krb5_boolean kssl_valid_cksumtype(krb5_cksumtype ctype);
  184. krb5_error_code krb5_kt_free_entry(krb5_context,krb5_keytab_entry FAR * );
  185. krb5_error_code kssl_krb5_auth_con_setrcache(krb5_context,
  186. krb5_auth_context,
  187. krb5_rcache);
  188. krb5_error_code kssl_krb5_get_server_rcache(krb5_context,
  189. krb5_const krb5_data *,
  190. krb5_rcache *);
  191. krb5_error_code kssl_krb5_auth_con_getrcache(krb5_context,
  192. krb5_auth_context,
  193. krb5_rcache *);
  194. /* Function pointers (almost all Kerberos functions are _stdcall) */
  195. static void (_stdcall *p_krb5_free_data_contents)(krb5_context, krb5_data *)
  196. =NULL;
  197. static void (_stdcall *p_krb5_free_principal)(krb5_context, krb5_principal )
  198. =NULL;
  199. static krb5_error_code(_stdcall *p_krb5_kt_resolve)
  200. (krb5_context, krb5_const char *, krb5_keytab *)=NULL;
  201. static krb5_error_code (_stdcall *p_krb5_kt_default)(krb5_context,
  202. krb5_keytab *)=NULL;
  203. static krb5_error_code (_stdcall *p_krb5_free_ticket)(krb5_context,
  204. krb5_ticket *)=NULL;
  205. static krb5_error_code (_stdcall *p_krb5_rd_req)(krb5_context,
  206. krb5_auth_context *,
  207. krb5_const krb5_data *,
  208. krb5_const_principal,
  209. krb5_keytab, krb5_flags *,
  210. krb5_ticket **)=NULL;
  211. static krb5_error_code (_stdcall *p_krb5_mk_req_extended)
  212. (krb5_context, krb5_auth_context *,
  213. krb5_const krb5_flags, krb5_data *, krb5_creds *,
  214. krb5_data * )=NULL;
  215. static krb5_error_code (_stdcall *p_krb5_init_context)(krb5_context *)=NULL;
  216. static void (_stdcall *p_krb5_free_context)(krb5_context)=NULL;
  217. static krb5_error_code (_stdcall *p_krb5_cc_default)(krb5_context,
  218. krb5_ccache *)=NULL;
  219. static krb5_error_code (_stdcall *p_krb5_sname_to_principal)
  220. (krb5_context, krb5_const char *, krb5_const char *,
  221. krb5_int32, krb5_principal *)=NULL;
  222. static krb5_error_code (_stdcall *p_krb5_get_credentials)
  223. (krb5_context, krb5_const krb5_flags, krb5_ccache,
  224. krb5_creds *, krb5_creds **)=NULL;
  225. static krb5_error_code (_stdcall *p_krb5_auth_con_init)
  226. (krb5_context, krb5_auth_context *)=NULL;
  227. static krb5_error_code (_stdcall *p_krb5_cc_get_principal)
  228. (krb5_context context, krb5_ccache cache,
  229. krb5_principal *principal)=NULL;
  230. static krb5_error_code (_stdcall *p_krb5_auth_con_free)
  231. (krb5_context, krb5_auth_context)=NULL;
  232. static krb5_error_code (_stdcall *p_krb5_decrypt_tkt_part)
  233. (krb5_context, krb5_const krb5_keyblock *,
  234. krb5_ticket *)=NULL;
  235. static krb5_error_code (_stdcall *p_krb5_timeofday)
  236. (krb5_context context, krb5_int32 *timeret)=NULL;
  237. static krb5_error_code (_stdcall *p_krb5_rc_default)
  238. (krb5_context context, krb5_rcache *rc)=NULL;
  239. static krb5_error_code (_stdcall *p_krb5_rc_initialize)
  240. (krb5_context context, krb5_rcache rc,
  241. krb5_deltat lifespan)=NULL;
  242. static krb5_error_code (_stdcall *p_krb5_rc_get_lifespan)
  243. (krb5_context context, krb5_rcache rc,
  244. krb5_deltat *lifespan)=NULL;
  245. static krb5_error_code (_stdcall *p_krb5_rc_destroy)
  246. (krb5_context context, krb5_rcache rc)=NULL;
  247. static krb5_boolean (_stdcall *p_krb5_principal_compare)
  248. (krb5_context, krb5_const_principal, krb5_const_principal)=NULL;
  249. static size_t (_stdcall *p_krb5_checksum_size)(krb5_context context,krb5_cksumtype ctype)=NULL;
  250. static krb5_boolean (_stdcall *p_valid_cksumtype)(krb5_cksumtype ctype)=NULL;
  251. static krb5_error_code (_stdcall *p_krb5_kt_free_entry)
  252. (krb5_context,krb5_keytab_entry * )=NULL;
  253. static krb5_error_code (_stdcall * p_krb5_auth_con_setrcache)(krb5_context,
  254. krb5_auth_context,
  255. krb5_rcache)=NULL;
  256. static krb5_error_code (_stdcall * p_krb5_get_server_rcache)(krb5_context,
  257. krb5_const krb5_data *,
  258. krb5_rcache *)=NULL;
  259. static krb5_error_code (* p_krb5_auth_con_getrcache)(krb5_context,
  260. krb5_auth_context,
  261. krb5_rcache *)=NULL;
  262. static krb5_error_code (_stdcall * p_krb5_kt_close)(krb5_context context,
  263. krb5_keytab keytab)=NULL;
  264. static krb5_error_code (_stdcall * p_krb5_kt_get_entry)(krb5_context context,
  265. krb5_keytab keytab,
  266. krb5_const_principal principal, krb5_kvno vno,
  267. krb5_enctype enctype, krb5_keytab_entry *entry)=NULL;
  268. static int krb5_loaded = 0; /* only attempt to initialize func ptrs once */
  269. /* Function to Load the Kerberos 5 DLL and initialize function pointers */
  270. void
  271. load_krb5_dll(void)
  272. {
  273. HANDLE hKRB5_32;
  274. krb5_loaded++;
  275. hKRB5_32 = LoadLibrary(TEXT("KRB5_32"));
  276. if (!hKRB5_32)
  277. return;
  278. (FARPROC) p_krb5_free_data_contents =
  279. GetProcAddress( hKRB5_32, "krb5_free_data_contents" );
  280. (FARPROC) p_krb5_free_context =
  281. GetProcAddress( hKRB5_32, "krb5_free_context" );
  282. (FARPROC) p_krb5_auth_con_free =
  283. GetProcAddress( hKRB5_32, "krb5_auth_con_free" );
  284. (FARPROC) p_krb5_free_principal =
  285. GetProcAddress( hKRB5_32, "krb5_free_principal" );
  286. (FARPROC) p_krb5_mk_req_extended =
  287. GetProcAddress( hKRB5_32, "krb5_mk_req_extended" );
  288. (FARPROC) p_krb5_get_credentials =
  289. GetProcAddress( hKRB5_32, "krb5_get_credentials" );
  290. (FARPROC) p_krb5_cc_get_principal =
  291. GetProcAddress( hKRB5_32, "krb5_cc_get_principal" );
  292. (FARPROC) p_krb5_cc_default =
  293. GetProcAddress( hKRB5_32, "krb5_cc_default" );
  294. (FARPROC) p_krb5_sname_to_principal =
  295. GetProcAddress( hKRB5_32, "krb5_sname_to_principal" );
  296. (FARPROC) p_krb5_init_context =
  297. GetProcAddress( hKRB5_32, "krb5_init_context" );
  298. (FARPROC) p_krb5_free_ticket =
  299. GetProcAddress( hKRB5_32, "krb5_free_ticket" );
  300. (FARPROC) p_krb5_rd_req =
  301. GetProcAddress( hKRB5_32, "krb5_rd_req" );
  302. (FARPROC) p_krb5_principal_compare =
  303. GetProcAddress( hKRB5_32, "krb5_principal_compare" );
  304. (FARPROC) p_krb5_decrypt_tkt_part =
  305. GetProcAddress( hKRB5_32, "krb5_decrypt_tkt_part" );
  306. (FARPROC) p_krb5_timeofday =
  307. GetProcAddress( hKRB5_32, "krb5_timeofday" );
  308. (FARPROC) p_krb5_rc_default =
  309. GetProcAddress( hKRB5_32, "krb5_rc_default" );
  310. (FARPROC) p_krb5_rc_initialize =
  311. GetProcAddress( hKRB5_32, "krb5_rc_initialize" );
  312. (FARPROC) p_krb5_rc_get_lifespan =
  313. GetProcAddress( hKRB5_32, "krb5_rc_get_lifespan" );
  314. (FARPROC) p_krb5_rc_destroy =
  315. GetProcAddress( hKRB5_32, "krb5_rc_destroy" );
  316. (FARPROC) p_krb5_kt_default =
  317. GetProcAddress( hKRB5_32, "krb5_kt_default" );
  318. (FARPROC) p_krb5_kt_resolve =
  319. GetProcAddress( hKRB5_32, "krb5_kt_resolve" );
  320. (FARPROC) p_krb5_auth_con_init =
  321. GetProcAddress( hKRB5_32, "krb5_auth_con_init" );
  322. (FARPROC) p_valid_cksumtype =
  323. GetProcAddress( hKRB5_32, "valid_cksumtype" );
  324. (FARPROC) p_krb5_checksum_size =
  325. GetProcAddress( hKRB5_32, "krb5_checksum_size" );
  326. (FARPROC) p_krb5_kt_free_entry =
  327. GetProcAddress( hKRB5_32, "krb5_kt_free_entry" );
  328. (FARPROC) p_krb5_auth_con_setrcache =
  329. GetProcAddress( hKRB5_32, "krb5_auth_con_setrcache" );
  330. (FARPROC) p_krb5_get_server_rcache =
  331. GetProcAddress( hKRB5_32, "krb5_get_server_rcache" );
  332. (FARPROC) p_krb5_auth_con_getrcache =
  333. GetProcAddress( hKRB5_32, "krb5_auth_con_getrcache" );
  334. (FARPROC) p_krb5_kt_close =
  335. GetProcAddress( hKRB5_32, "krb5_kt_close" );
  336. (FARPROC) p_krb5_kt_get_entry =
  337. GetProcAddress( hKRB5_32, "krb5_kt_get_entry" );
  338. }
  339. /* Stubs for each function to be dynamicly loaded */
  340. void
  341. kssl_krb5_free_data_contents(krb5_context CO, krb5_data * data)
  342. {
  343. if (!krb5_loaded)
  344. load_krb5_dll();
  345. if ( p_krb5_free_data_contents )
  346. p_krb5_free_data_contents(CO,data);
  347. }
  348. krb5_error_code
  349. kssl_krb5_mk_req_extended (krb5_context CO,
  350. krb5_auth_context * pACO,
  351. krb5_const krb5_flags F,
  352. krb5_data * pD1,
  353. krb5_creds * pC,
  354. krb5_data * pD2)
  355. {
  356. if (!krb5_loaded)
  357. load_krb5_dll();
  358. if ( p_krb5_mk_req_extended )
  359. return(p_krb5_mk_req_extended(CO,pACO,F,pD1,pC,pD2));
  360. else
  361. return KRB5KRB_ERR_GENERIC;
  362. }
  363. krb5_error_code
  364. kssl_krb5_auth_con_init(krb5_context CO,
  365. krb5_auth_context * pACO)
  366. {
  367. if (!krb5_loaded)
  368. load_krb5_dll();
  369. if ( p_krb5_auth_con_init )
  370. return(p_krb5_auth_con_init(CO,pACO));
  371. else
  372. return KRB5KRB_ERR_GENERIC;
  373. }
  374. krb5_error_code
  375. kssl_krb5_auth_con_free (krb5_context CO,
  376. krb5_auth_context ACO)
  377. {
  378. if (!krb5_loaded)
  379. load_krb5_dll();
  380. if ( p_krb5_auth_con_free )
  381. return(p_krb5_auth_con_free(CO,ACO));
  382. else
  383. return KRB5KRB_ERR_GENERIC;
  384. }
  385. krb5_error_code
  386. kssl_krb5_get_credentials(krb5_context CO,
  387. krb5_const krb5_flags F,
  388. krb5_ccache CC,
  389. krb5_creds * pCR,
  390. krb5_creds ** ppCR)
  391. {
  392. if (!krb5_loaded)
  393. load_krb5_dll();
  394. if ( p_krb5_get_credentials )
  395. return(p_krb5_get_credentials(CO,F,CC,pCR,ppCR));
  396. else
  397. return KRB5KRB_ERR_GENERIC;
  398. }
  399. krb5_error_code
  400. kssl_krb5_sname_to_principal(krb5_context CO,
  401. krb5_const char * pC1,
  402. krb5_const char * pC2,
  403. krb5_int32 I,
  404. krb5_principal * pPR)
  405. {
  406. if (!krb5_loaded)
  407. load_krb5_dll();
  408. if ( p_krb5_sname_to_principal )
  409. return(p_krb5_sname_to_principal(CO,pC1,pC2,I,pPR));
  410. else
  411. return KRB5KRB_ERR_GENERIC;
  412. }
  413. krb5_error_code
  414. kssl_krb5_cc_default(krb5_context CO,
  415. krb5_ccache * pCC)
  416. {
  417. if (!krb5_loaded)
  418. load_krb5_dll();
  419. if ( p_krb5_cc_default )
  420. return(p_krb5_cc_default(CO,pCC));
  421. else
  422. return KRB5KRB_ERR_GENERIC;
  423. }
  424. krb5_error_code
  425. kssl_krb5_init_context(krb5_context * pCO)
  426. {
  427. if (!krb5_loaded)
  428. load_krb5_dll();
  429. if ( p_krb5_init_context )
  430. return(p_krb5_init_context(pCO));
  431. else
  432. return KRB5KRB_ERR_GENERIC;
  433. }
  434. void
  435. kssl_krb5_free_context(krb5_context CO)
  436. {
  437. if (!krb5_loaded)
  438. load_krb5_dll();
  439. if ( p_krb5_free_context )
  440. p_krb5_free_context(CO);
  441. }
  442. void
  443. kssl_krb5_free_principal(krb5_context c, krb5_principal p)
  444. {
  445. if (!krb5_loaded)
  446. load_krb5_dll();
  447. if ( p_krb5_free_principal )
  448. p_krb5_free_principal(c,p);
  449. }
  450. krb5_error_code
  451. kssl_krb5_kt_resolve(krb5_context con,
  452. krb5_const char * sz,
  453. krb5_keytab * kt)
  454. {
  455. if (!krb5_loaded)
  456. load_krb5_dll();
  457. if ( p_krb5_kt_resolve )
  458. return(p_krb5_kt_resolve(con,sz,kt));
  459. else
  460. return KRB5KRB_ERR_GENERIC;
  461. }
  462. krb5_error_code
  463. kssl_krb5_kt_default(krb5_context con,
  464. krb5_keytab * kt)
  465. {
  466. if (!krb5_loaded)
  467. load_krb5_dll();
  468. if ( p_krb5_kt_default )
  469. return(p_krb5_kt_default(con,kt));
  470. else
  471. return KRB5KRB_ERR_GENERIC;
  472. }
  473. krb5_error_code
  474. kssl_krb5_free_ticket(krb5_context con,
  475. krb5_ticket * kt)
  476. {
  477. if (!krb5_loaded)
  478. load_krb5_dll();
  479. if ( p_krb5_free_ticket )
  480. return(p_krb5_free_ticket(con,kt));
  481. else
  482. return KRB5KRB_ERR_GENERIC;
  483. }
  484. krb5_error_code
  485. kssl_krb5_rd_req(krb5_context con, krb5_auth_context * pacon,
  486. krb5_const krb5_data * data,
  487. krb5_const_principal princ, krb5_keytab keytab,
  488. krb5_flags * flags, krb5_ticket ** pptkt)
  489. {
  490. if (!krb5_loaded)
  491. load_krb5_dll();
  492. if ( p_krb5_rd_req )
  493. return(p_krb5_rd_req(con,pacon,data,princ,keytab,flags,pptkt));
  494. else
  495. return KRB5KRB_ERR_GENERIC;
  496. }
  497. krb5_boolean
  498. krb5_principal_compare(krb5_context con, krb5_const_principal princ1,
  499. krb5_const_principal princ2)
  500. {
  501. if (!krb5_loaded)
  502. load_krb5_dll();
  503. if ( p_krb5_principal_compare )
  504. return(p_krb5_principal_compare(con,princ1,princ2));
  505. else
  506. return KRB5KRB_ERR_GENERIC;
  507. }
  508. krb5_error_code
  509. krb5_decrypt_tkt_part(krb5_context con, krb5_const krb5_keyblock *keys,
  510. krb5_ticket *ticket)
  511. {
  512. if (!krb5_loaded)
  513. load_krb5_dll();
  514. if ( p_krb5_decrypt_tkt_part )
  515. return(p_krb5_decrypt_tkt_part(con,keys,ticket));
  516. else
  517. return KRB5KRB_ERR_GENERIC;
  518. }
  519. krb5_error_code
  520. krb5_timeofday(krb5_context con, krb5_int32 *timeret)
  521. {
  522. if (!krb5_loaded)
  523. load_krb5_dll();
  524. if ( p_krb5_timeofday )
  525. return(p_krb5_timeofday(con,timeret));
  526. else
  527. return KRB5KRB_ERR_GENERIC;
  528. }
  529. krb5_error_code
  530. krb5_rc_default(krb5_context con, krb5_rcache *rc)
  531. {
  532. if (!krb5_loaded)
  533. load_krb5_dll();
  534. if ( p_krb5_rc_default )
  535. return(p_krb5_rc_default(con,rc));
  536. else
  537. return KRB5KRB_ERR_GENERIC;
  538. }
  539. krb5_error_code
  540. krb5_rc_initialize(krb5_context con, krb5_rcache rc, krb5_deltat lifespan)
  541. {
  542. if (!krb5_loaded)
  543. load_krb5_dll();
  544. if ( p_krb5_rc_initialize )
  545. return(p_krb5_rc_initialize(con, rc, lifespan));
  546. else
  547. return KRB5KRB_ERR_GENERIC;
  548. }
  549. krb5_error_code
  550. krb5_rc_get_lifespan(krb5_context con, krb5_rcache rc, krb5_deltat *lifespanp)
  551. {
  552. if (!krb5_loaded)
  553. load_krb5_dll();
  554. if ( p_krb5_rc_get_lifespan )
  555. return(p_krb5_rc_get_lifespan(con, rc, lifespanp));
  556. else
  557. return KRB5KRB_ERR_GENERIC;
  558. }
  559. krb5_error_code
  560. krb5_rc_destroy(krb5_context con, krb5_rcache rc)
  561. {
  562. if (!krb5_loaded)
  563. load_krb5_dll();
  564. if ( p_krb5_rc_destroy )
  565. return(p_krb5_rc_destroy(con, rc));
  566. else
  567. return KRB5KRB_ERR_GENERIC;
  568. }
  569. size_t
  570. krb5_checksum_size(krb5_context context,krb5_cksumtype ctype)
  571. {
  572. if (!krb5_loaded)
  573. load_krb5_dll();
  574. if ( p_krb5_checksum_size )
  575. return(p_krb5_checksum_size(context, ctype));
  576. else
  577. return KRB5KRB_ERR_GENERIC;
  578. }
  579. krb5_boolean
  580. valid_cksumtype(krb5_cksumtype ctype)
  581. {
  582. if (!krb5_loaded)
  583. load_krb5_dll();
  584. if ( p_valid_cksumtype )
  585. return(p_valid_cksumtype(ctype));
  586. else
  587. return KRB5KRB_ERR_GENERIC;
  588. }
  589. krb5_error_code
  590. krb5_kt_free_entry(krb5_context con,krb5_keytab_entry * entry)
  591. {
  592. if (!krb5_loaded)
  593. load_krb5_dll();
  594. if ( p_krb5_kt_free_entry )
  595. return(p_krb5_kt_free_entry(con,entry));
  596. else
  597. return KRB5KRB_ERR_GENERIC;
  598. }
  599. /* Structure definitions */
  600. #ifndef NO_DEF_KRB5_CCACHE
  601. #ifndef krb5_x
  602. #define krb5_x(ptr,args) ((ptr)?((*(ptr)) args):(abort(),1))
  603. #define krb5_xc(ptr,args) ((ptr)?((*(ptr)) args):(abort(),(char*)0))
  604. #endif
  605. typedef krb5_pointer krb5_cc_cursor; /* cursor for sequential lookup */
  606. typedef struct _krb5_ccache
  607. {
  608. krb5_magic magic;
  609. struct _krb5_cc_ops FAR *ops;
  610. krb5_pointer data;
  611. } *krb5_ccache;
  612. typedef struct _krb5_cc_ops
  613. {
  614. krb5_magic magic;
  615. char *prefix;
  616. char * (KRB5_CALLCONV *get_name)
  617. (krb5_context, krb5_ccache);
  618. krb5_error_code (KRB5_CALLCONV *resolve)
  619. (krb5_context, krb5_ccache *, const char *);
  620. krb5_error_code (KRB5_CALLCONV *gen_new)
  621. (krb5_context, krb5_ccache *);
  622. krb5_error_code (KRB5_CALLCONV *init)
  623. (krb5_context, krb5_ccache, krb5_principal);
  624. krb5_error_code (KRB5_CALLCONV *destroy)
  625. (krb5_context, krb5_ccache);
  626. krb5_error_code (KRB5_CALLCONV *close)
  627. (krb5_context, krb5_ccache);
  628. krb5_error_code (KRB5_CALLCONV *store)
  629. (krb5_context, krb5_ccache, krb5_creds *);
  630. krb5_error_code (KRB5_CALLCONV *retrieve)
  631. (krb5_context, krb5_ccache,
  632. krb5_flags, krb5_creds *, krb5_creds *);
  633. krb5_error_code (KRB5_CALLCONV *get_princ)
  634. (krb5_context, krb5_ccache, krb5_principal *);
  635. krb5_error_code (KRB5_CALLCONV *get_first)
  636. (krb5_context, krb5_ccache, krb5_cc_cursor *);
  637. krb5_error_code (KRB5_CALLCONV *get_next)
  638. (krb5_context, krb5_ccache,
  639. krb5_cc_cursor *, krb5_creds *);
  640. krb5_error_code (KRB5_CALLCONV *end_get)
  641. (krb5_context, krb5_ccache, krb5_cc_cursor *);
  642. krb5_error_code (KRB5_CALLCONV *remove_cred)
  643. (krb5_context, krb5_ccache,
  644. krb5_flags, krb5_creds *);
  645. krb5_error_code (KRB5_CALLCONV *set_flags)
  646. (krb5_context, krb5_ccache, krb5_flags);
  647. } krb5_cc_ops;
  648. #endif /* NO_DEF_KRB5_CCACHE */
  649. krb5_error_code
  650. kssl_krb5_cc_get_principal
  651. (krb5_context context, krb5_ccache cache,
  652. krb5_principal *principal)
  653. {
  654. if ( p_krb5_cc_get_principal )
  655. return(p_krb5_cc_get_principal(context,cache,principal));
  656. else
  657. return(krb5_x
  658. ((cache)->ops->get_princ,(context, cache, principal)));
  659. }
  660. krb5_error_code
  661. kssl_krb5_auth_con_setrcache(krb5_context con, krb5_auth_context acon,
  662. krb5_rcache rcache)
  663. {
  664. if ( p_krb5_auth_con_setrcache )
  665. return(p_krb5_auth_con_setrcache(con,acon,rcache));
  666. else
  667. return KRB5KRB_ERR_GENERIC;
  668. }
  669. krb5_error_code
  670. kssl_krb5_get_server_rcache(krb5_context con, krb5_const krb5_data * data,
  671. krb5_rcache * rcache)
  672. {
  673. if ( p_krb5_get_server_rcache )
  674. return(p_krb5_get_server_rcache(con,data,rcache));
  675. else
  676. return KRB5KRB_ERR_GENERIC;
  677. }
  678. krb5_error_code
  679. kssl_krb5_auth_con_getrcache(krb5_context con, krb5_auth_context acon,
  680. krb5_rcache * prcache)
  681. {
  682. if ( p_krb5_auth_con_getrcache )
  683. return(p_krb5_auth_con_getrcache(con,acon, prcache));
  684. else
  685. return KRB5KRB_ERR_GENERIC;
  686. }
  687. krb5_error_code
  688. kssl_krb5_kt_close(krb5_context context, krb5_keytab keytab)
  689. {
  690. if ( p_krb5_kt_close )
  691. return(p_krb5_kt_close(context,keytab));
  692. else
  693. return KRB5KRB_ERR_GENERIC;
  694. }
  695. krb5_error_code
  696. kssl_krb5_kt_get_entry(krb5_context context, krb5_keytab keytab,
  697. krb5_const_principal principal, krb5_kvno vno,
  698. krb5_enctype enctype, krb5_keytab_entry *entry)
  699. {
  700. if ( p_krb5_kt_get_entry )
  701. return(p_krb5_kt_get_entry(context,keytab,principal,vno,enctype,entry));
  702. else
  703. return KRB5KRB_ERR_GENERIC;
  704. }
  705. #endif /* OPENSSL_SYS_WINDOWS || OPENSSL_SYS_WIN32 */
  706. /* memory allocation functions for non-temporary storage
  707. * (e.g. stuff that gets saved into the kssl context) */
  708. static void* kssl_calloc(size_t nmemb, size_t size)
  709. {
  710. void* p;
  711. p=OPENSSL_malloc(nmemb*size);
  712. if (p){
  713. memset(p, 0, nmemb*size);
  714. }
  715. return p;
  716. }
  717. #define kssl_malloc(size) OPENSSL_malloc((size))
  718. #define kssl_realloc(ptr, size) OPENSSL_realloc(ptr, size)
  719. #define kssl_free(ptr) OPENSSL_free((ptr))
  720. char
  721. *kstring(char *string)
  722. {
  723. static char *null = "[NULL]";
  724. return ((string == NULL)? null: string);
  725. }
  726. /* Given KRB5 enctype (basically DES or 3DES),
  727. ** return closest match openssl EVP_ encryption algorithm.
  728. ** Return NULL for unknown or problematic (krb5_dk_encrypt) enctypes.
  729. ** Assume ENCTYPE_*_RAW (krb5_raw_encrypt) are OK.
  730. */
  731. const EVP_CIPHER *
  732. kssl_map_enc(krb5_enctype enctype)
  733. {
  734. switch (enctype)
  735. {
  736. case ENCTYPE_DES_HMAC_SHA1: /* EVP_des_cbc(); */
  737. case ENCTYPE_DES_CBC_CRC:
  738. case ENCTYPE_DES_CBC_MD4:
  739. case ENCTYPE_DES_CBC_MD5:
  740. case ENCTYPE_DES_CBC_RAW:
  741. return EVP_des_cbc();
  742. break;
  743. case ENCTYPE_DES3_CBC_SHA1: /* EVP_des_ede3_cbc(); */
  744. case ENCTYPE_DES3_CBC_SHA:
  745. case ENCTYPE_DES3_CBC_RAW:
  746. return EVP_des_ede3_cbc();
  747. break;
  748. default: return NULL;
  749. break;
  750. }
  751. }
  752. /* Return true:1 if p "looks like" the start of the real authenticator
  753. ** described in kssl_skip_confound() below. The ASN.1 pattern is
  754. ** "62 xx 30 yy" (APPLICATION-2, SEQUENCE), where xx-yy =~ 2, and
  755. ** xx and yy are possibly multi-byte length fields.
  756. */
  757. static int kssl_test_confound(unsigned char *p)
  758. {
  759. int len = 2;
  760. int xx = 0, yy = 0;
  761. if (*p++ != 0x62) return 0;
  762. if (*p > 0x82) return 0;
  763. switch(*p) {
  764. case 0x82: p++; xx = (*p++ << 8); xx += *p++; break;
  765. case 0x81: p++; xx = *p++; break;
  766. case 0x80: return 0;
  767. default: xx = *p++; break;
  768. }
  769. if (*p++ != 0x30) return 0;
  770. if (*p > 0x82) return 0;
  771. switch(*p) {
  772. case 0x82: p++; len+=2; yy = (*p++ << 8); yy += *p++; break;
  773. case 0x81: p++; len++; yy = *p++; break;
  774. case 0x80: return 0;
  775. default: yy = *p++; break;
  776. }
  777. return (xx - len == yy)? 1: 0;
  778. }
  779. /* Allocate, fill, and return cksumlens array of checksum lengths.
  780. ** This array holds just the unique elements from the krb5_cksumarray[].
  781. ** array[n] == 0 signals end of data.
  782. **
  783. ** The krb5_cksumarray[] was an internal variable that has since been
  784. ** replaced by a more general method for storing the data. It should
  785. ** not be used. Instead we use real API calls and make a guess for
  786. ** what the highest assigned CKSUMTYPE_ constant is. As of 1.2.2
  787. ** it is 0x000c (CKSUMTYPE_HMAC_SHA1_DES3). So we will use 0x0010.
  788. */
  789. static size_t *populate_cksumlens(void)
  790. {
  791. int i, j, n;
  792. static size_t *cklens = NULL;
  793. #ifdef KRB5_MIT_OLD11
  794. n = krb5_max_cksum;
  795. #else
  796. n = 0x0010;
  797. #endif /* KRB5_MIT_OLD11 */
  798. #ifdef KRB5CHECKAUTH
  799. if (!cklens && !(cklens = (size_t *) calloc(sizeof(int),n+1))) return NULL;
  800. for (i=0; i < n; i++) {
  801. if (!valid_cksumtype(i)) continue; /* array has holes */
  802. for (j=0; j < n; j++) {
  803. if (cklens[j] == 0) {
  804. cklens[j] = krb5_checksum_size(NULL,i);
  805. break; /* krb5 elem was new: add */
  806. }
  807. if (cklens[j] == krb5_checksum_size(NULL,i)) {
  808. break; /* ignore duplicate elements */
  809. }
  810. }
  811. }
  812. #endif /* KRB5CHECKAUTH */
  813. return cklens;
  814. }
  815. /* Return pointer to start of real authenticator within authenticator, or
  816. ** return NULL on error.
  817. ** Decrypted authenticator looks like this:
  818. ** [0 or 8 byte confounder] [4-24 byte checksum] [real authent'r]
  819. ** This hackery wouldn't be necessary if MIT KRB5 1.0.6 had the
  820. ** krb5_auth_con_getcksumtype() function advertised in its krb5.h.
  821. */
  822. unsigned char *kssl_skip_confound(krb5_enctype etype, unsigned char *a)
  823. {
  824. int i, conlen;
  825. size_t cklen;
  826. static size_t *cksumlens = NULL;
  827. unsigned char *test_auth;
  828. conlen = (etype)? 8: 0;
  829. if (!cksumlens && !(cksumlens = populate_cksumlens())) return NULL;
  830. for (i=0; (cklen = cksumlens[i]) != 0; i++)
  831. {
  832. test_auth = a + conlen + cklen;
  833. if (kssl_test_confound(test_auth)) return test_auth;
  834. }
  835. return NULL;
  836. }
  837. /* Set kssl_err error info when reason text is a simple string
  838. ** kssl_err = struct { int reason; char text[KSSL_ERR_MAX+1]; }
  839. */
  840. void
  841. kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text)
  842. {
  843. if (kssl_err == NULL) return;
  844. kssl_err->reason = reason;
  845. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX, "%s", text);
  846. return;
  847. }
  848. /* Display contents of krb5_data struct, for debugging
  849. */
  850. void
  851. print_krb5_data(char *label, krb5_data *kdata)
  852. {
  853. int i;
  854. printf("%s[%d] ", label, kdata->length);
  855. for (i=0; i < (int)kdata->length; i++)
  856. {
  857. if (0 && isprint((int) kdata->data[i]))
  858. printf( "%c ", kdata->data[i]);
  859. else
  860. printf( "%02x ", (unsigned char) kdata->data[i]);
  861. }
  862. printf("\n");
  863. }
  864. /* Display contents of krb5_authdata struct, for debugging
  865. */
  866. void
  867. print_krb5_authdata(char *label, krb5_authdata **adata)
  868. {
  869. if (adata == NULL)
  870. {
  871. printf("%s, authdata==0\n", label);
  872. return;
  873. }
  874. printf("%s [%p]\n", label, (void *)adata);
  875. #if 0
  876. {
  877. int i;
  878. printf("%s[at%d:%d] ", label, adata->ad_type, adata->length);
  879. for (i=0; i < adata->length; i++)
  880. {
  881. printf((isprint(adata->contents[i]))? "%c ": "%02x",
  882. adata->contents[i]);
  883. }
  884. printf("\n");
  885. }
  886. #endif
  887. }
  888. /* Display contents of krb5_keyblock struct, for debugging
  889. */
  890. void
  891. print_krb5_keyblock(char *label, krb5_keyblock *keyblk)
  892. {
  893. int i;
  894. if (keyblk == NULL)
  895. {
  896. printf("%s, keyblk==0\n", label);
  897. return;
  898. }
  899. #ifdef KRB5_HEIMDAL
  900. printf("%s\n\t[et%d:%d]: ", label, keyblk->keytype,
  901. keyblk->keyvalue->length);
  902. for (i=0; i < (int)keyblk->keyvalue->length; i++)
  903. {
  904. printf("%02x",(unsigned char *)(keyblk->keyvalue->contents)[i]);
  905. }
  906. printf("\n");
  907. #else
  908. printf("%s\n\t[et%d:%d]: ", label, keyblk->enctype, keyblk->length);
  909. for (i=0; i < (int)keyblk->length; i++)
  910. {
  911. printf("%02x",keyblk->contents[i]);
  912. }
  913. printf("\n");
  914. #endif
  915. }
  916. /* Display contents of krb5_principal_data struct, for debugging
  917. ** (krb5_principal is typedef'd == krb5_principal_data *)
  918. */
  919. static void
  920. print_krb5_princ(char *label, krb5_principal_data *princ)
  921. {
  922. int i, ui, uj;
  923. printf("%s principal Realm: ", label);
  924. if (princ == NULL) return;
  925. for (ui=0; ui < (int)princ->realm.length; ui++) putchar(princ->realm.data[ui]);
  926. printf(" (nametype %d) has %d strings:\n", princ->type,princ->length);
  927. for (i=0; i < (int)princ->length; i++)
  928. {
  929. printf("\t%d [%d]: ", i, princ->data[i].length);
  930. for (uj=0; uj < (int)princ->data[i].length; uj++) {
  931. putchar(princ->data[i].data[uj]);
  932. }
  933. printf("\n");
  934. }
  935. return;
  936. }
  937. /* Given krb5 service (typically "kssl") and hostname in kssl_ctx,
  938. ** Return encrypted Kerberos ticket for service @ hostname.
  939. ** If authenp is non-NULL, also return encrypted authenticator,
  940. ** whose data should be freed by caller.
  941. ** (Originally was: Create Kerberos AP_REQ message for SSL Client.)
  942. **
  943. ** 19990628 VRS Started; Returns Kerberos AP_REQ message.
  944. ** 20010409 VRS Modified for RFC2712; Returns enc tkt.
  945. ** 20010606 VRS May also return optional authenticator.
  946. */
  947. krb5_error_code
  948. kssl_cget_tkt( /* UPDATE */ KSSL_CTX *kssl_ctx,
  949. /* OUT */ krb5_data **enc_ticketp,
  950. /* UPDATE */ krb5_data *authenp,
  951. /* OUT */ KSSL_ERR *kssl_err)
  952. {
  953. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  954. krb5_context krb5context = NULL;
  955. krb5_auth_context krb5auth_context = NULL;
  956. krb5_ccache krb5ccdef = NULL;
  957. krb5_creds krb5creds, *krb5credsp = NULL;
  958. krb5_data krb5_app_req;
  959. kssl_err_set(kssl_err, 0, "");
  960. memset((char *)&krb5creds, 0, sizeof(krb5creds));
  961. if (!kssl_ctx)
  962. {
  963. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  964. "No kssl_ctx defined.\n");
  965. goto err;
  966. }
  967. else if (!kssl_ctx->service_host)
  968. {
  969. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  970. "kssl_ctx service_host undefined.\n");
  971. goto err;
  972. }
  973. if ((krb5rc = krb5_init_context(&krb5context)) != 0)
  974. {
  975. BIO_snprintf(kssl_err->text,KSSL_ERR_MAX,
  976. "krb5_init_context() fails: %d\n", krb5rc);
  977. kssl_err->reason = SSL_R_KRB5_C_INIT;
  978. goto err;
  979. }
  980. if ((krb5rc = krb5_sname_to_principal(krb5context,
  981. kssl_ctx->service_host,
  982. (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC,
  983. KRB5_NT_SRV_HST, &krb5creds.server)) != 0)
  984. {
  985. BIO_snprintf(kssl_err->text,KSSL_ERR_MAX,
  986. "krb5_sname_to_principal() fails for %s/%s\n",
  987. kssl_ctx->service_host,
  988. (kssl_ctx->service_name)? kssl_ctx->service_name:
  989. KRB5SVC);
  990. kssl_err->reason = SSL_R_KRB5_C_INIT;
  991. goto err;
  992. }
  993. if ((krb5rc = krb5_cc_default(krb5context, &krb5ccdef)) != 0)
  994. {
  995. kssl_err_set(kssl_err, SSL_R_KRB5_C_CC_PRINC,
  996. "krb5_cc_default fails.\n");
  997. goto err;
  998. }
  999. if ((krb5rc = krb5_cc_get_principal(krb5context, krb5ccdef,
  1000. &krb5creds.client)) != 0)
  1001. {
  1002. kssl_err_set(kssl_err, SSL_R_KRB5_C_CC_PRINC,
  1003. "krb5_cc_get_principal() fails.\n");
  1004. goto err;
  1005. }
  1006. if ((krb5rc = krb5_get_credentials(krb5context, 0, krb5ccdef,
  1007. &krb5creds, &krb5credsp)) != 0)
  1008. {
  1009. kssl_err_set(kssl_err, SSL_R_KRB5_C_GET_CRED,
  1010. "krb5_get_credentials() fails.\n");
  1011. goto err;
  1012. }
  1013. *enc_ticketp = &krb5credsp->ticket;
  1014. #ifdef KRB5_HEIMDAL
  1015. kssl_ctx->enctype = krb5credsp->session.keytype;
  1016. #else
  1017. kssl_ctx->enctype = krb5credsp->keyblock.enctype;
  1018. #endif
  1019. krb5rc = KRB5KRB_ERR_GENERIC;
  1020. /* caller should free data of krb5_app_req */
  1021. /* 20010406 VRS deleted for real KerberosWrapper
  1022. ** 20010605 VRS reinstated to offer Authenticator to KerberosWrapper
  1023. */
  1024. krb5_app_req.length = 0;
  1025. if (authenp)
  1026. {
  1027. krb5_data krb5in_data;
  1028. const unsigned char *p;
  1029. long arlen;
  1030. KRB5_APREQBODY *ap_req;
  1031. authenp->length = 0;
  1032. krb5in_data.data = NULL;
  1033. krb5in_data.length = 0;
  1034. if ((krb5rc = krb5_mk_req_extended(krb5context,
  1035. &krb5auth_context, 0, &krb5in_data, krb5credsp,
  1036. &krb5_app_req)) != 0)
  1037. {
  1038. kssl_err_set(kssl_err, SSL_R_KRB5_C_MK_REQ,
  1039. "krb5_mk_req_extended() fails.\n");
  1040. goto err;
  1041. }
  1042. arlen = krb5_app_req.length;
  1043. p = (unsigned char *)krb5_app_req.data;
  1044. ap_req = (KRB5_APREQBODY *) d2i_KRB5_APREQ(NULL, &p, arlen);
  1045. if (ap_req)
  1046. {
  1047. authenp->length = i2d_KRB5_ENCDATA(
  1048. ap_req->authenticator, NULL);
  1049. if (authenp->length &&
  1050. (authenp->data = malloc(authenp->length)))
  1051. {
  1052. unsigned char *adp = (unsigned char *)authenp->data;
  1053. authenp->length = i2d_KRB5_ENCDATA(
  1054. ap_req->authenticator, &adp);
  1055. }
  1056. }
  1057. if (ap_req) KRB5_APREQ_free((KRB5_APREQ *) ap_req);
  1058. if (krb5_app_req.length)
  1059. kssl_krb5_free_data_contents(krb5context,&krb5_app_req);
  1060. }
  1061. #ifdef KRB5_HEIMDAL
  1062. if (kssl_ctx_setkey(kssl_ctx, &krb5credsp->session))
  1063. {
  1064. kssl_err_set(kssl_err, SSL_R_KRB5_C_INIT,
  1065. "kssl_ctx_setkey() fails.\n");
  1066. }
  1067. #else
  1068. if (kssl_ctx_setkey(kssl_ctx, &krb5credsp->keyblock))
  1069. {
  1070. kssl_err_set(kssl_err, SSL_R_KRB5_C_INIT,
  1071. "kssl_ctx_setkey() fails.\n");
  1072. }
  1073. #endif
  1074. else krb5rc = 0;
  1075. err:
  1076. #ifdef KSSL_DEBUG
  1077. kssl_ctx_show(kssl_ctx);
  1078. #endif /* KSSL_DEBUG */
  1079. if (krb5creds.client) krb5_free_principal(krb5context,
  1080. krb5creds.client);
  1081. if (krb5creds.server) krb5_free_principal(krb5context,
  1082. krb5creds.server);
  1083. if (krb5auth_context) krb5_auth_con_free(krb5context,
  1084. krb5auth_context);
  1085. if (krb5context) krb5_free_context(krb5context);
  1086. return (krb5rc);
  1087. }
  1088. /* Given d2i_-decoded asn1ticket, allocate and return a new krb5_ticket.
  1089. ** Return Kerberos error code and kssl_err struct on error.
  1090. ** Allocates krb5_ticket and krb5_principal; caller should free these.
  1091. **
  1092. ** 20010410 VRS Implemented krb5_decode_ticket() as
  1093. ** old_krb5_decode_ticket(). Missing from MIT1.0.6.
  1094. ** 20010615 VRS Re-cast as openssl/asn1 d2i_*() functions.
  1095. ** Re-used some of the old krb5_decode_ticket()
  1096. ** code here. This tkt should alloc/free just
  1097. ** like the real thing.
  1098. */
  1099. static krb5_error_code
  1100. kssl_TKT2tkt( /* IN */ krb5_context krb5context,
  1101. /* IN */ KRB5_TKTBODY *asn1ticket,
  1102. /* OUT */ krb5_ticket **krb5ticket,
  1103. /* OUT */ KSSL_ERR *kssl_err )
  1104. {
  1105. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  1106. krb5_ticket *new5ticket = NULL;
  1107. ASN1_GENERALSTRING *gstr_svc, *gstr_host;
  1108. *krb5ticket = NULL;
  1109. if (asn1ticket == NULL || asn1ticket->realm == NULL ||
  1110. asn1ticket->sname == NULL ||
  1111. sk_ASN1_GENERALSTRING_num(asn1ticket->sname->namestring) < 2)
  1112. {
  1113. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1114. "Null field in asn1ticket.\n");
  1115. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1116. return KRB5KRB_ERR_GENERIC;
  1117. }
  1118. if ((new5ticket = (krb5_ticket *) calloc(1, sizeof(krb5_ticket)))==NULL)
  1119. {
  1120. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1121. "Unable to allocate new krb5_ticket.\n");
  1122. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1123. return ENOMEM; /* or KRB5KRB_ERR_GENERIC; */
  1124. }
  1125. gstr_svc = sk_ASN1_GENERALSTRING_value(asn1ticket->sname->namestring, 0);
  1126. gstr_host = sk_ASN1_GENERALSTRING_value(asn1ticket->sname->namestring, 1);
  1127. if ((krb5rc = kssl_build_principal_2(krb5context,
  1128. &new5ticket->server,
  1129. asn1ticket->realm->length, (char *)asn1ticket->realm->data,
  1130. gstr_svc->length, (char *)gstr_svc->data,
  1131. gstr_host->length, (char *)gstr_host->data)) != 0)
  1132. {
  1133. free(new5ticket);
  1134. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1135. "Error building ticket server principal.\n");
  1136. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1137. return krb5rc; /* or KRB5KRB_ERR_GENERIC; */
  1138. }
  1139. krb5_princ_type(krb5context, new5ticket->server) =
  1140. asn1ticket->sname->nametype->data[0];
  1141. new5ticket->enc_part.enctype = asn1ticket->encdata->etype->data[0];
  1142. new5ticket->enc_part.kvno = asn1ticket->encdata->kvno->data[0];
  1143. new5ticket->enc_part.ciphertext.length =
  1144. asn1ticket->encdata->cipher->length;
  1145. if ((new5ticket->enc_part.ciphertext.data =
  1146. calloc(1, asn1ticket->encdata->cipher->length)) == NULL)
  1147. {
  1148. free(new5ticket);
  1149. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1150. "Error allocating cipher in krb5ticket.\n");
  1151. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1152. return KRB5KRB_ERR_GENERIC;
  1153. }
  1154. else
  1155. {
  1156. memcpy(new5ticket->enc_part.ciphertext.data,
  1157. asn1ticket->encdata->cipher->data,
  1158. asn1ticket->encdata->cipher->length);
  1159. }
  1160. *krb5ticket = new5ticket;
  1161. return 0;
  1162. }
  1163. /* Given krb5 service name in KSSL_CTX *kssl_ctx (typically "kssl"),
  1164. ** and krb5 AP_REQ message & message length,
  1165. ** Return Kerberos session key and client principle
  1166. ** to SSL Server in KSSL_CTX *kssl_ctx.
  1167. **
  1168. ** 19990702 VRS Started.
  1169. */
  1170. krb5_error_code
  1171. kssl_sget_tkt( /* UPDATE */ KSSL_CTX *kssl_ctx,
  1172. /* IN */ krb5_data *indata,
  1173. /* OUT */ krb5_ticket_times *ttimes,
  1174. /* OUT */ KSSL_ERR *kssl_err )
  1175. {
  1176. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  1177. static krb5_context krb5context = NULL;
  1178. static krb5_auth_context krb5auth_context = NULL;
  1179. krb5_ticket *krb5ticket = NULL;
  1180. KRB5_TKTBODY *asn1ticket = NULL;
  1181. const unsigned char *p;
  1182. krb5_keytab krb5keytab = NULL;
  1183. krb5_keytab_entry kt_entry;
  1184. krb5_principal krb5server;
  1185. krb5_rcache rcache = NULL;
  1186. kssl_err_set(kssl_err, 0, "");
  1187. if (!kssl_ctx)
  1188. {
  1189. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1190. "No kssl_ctx defined.\n");
  1191. goto err;
  1192. }
  1193. #ifdef KSSL_DEBUG
  1194. printf("in kssl_sget_tkt(%s)\n", kstring(kssl_ctx->service_name));
  1195. #endif /* KSSL_DEBUG */
  1196. if (!krb5context && (krb5rc = krb5_init_context(&krb5context)))
  1197. {
  1198. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1199. "krb5_init_context() fails.\n");
  1200. goto err;
  1201. }
  1202. if (krb5auth_context &&
  1203. (krb5rc = krb5_auth_con_free(krb5context, krb5auth_context)))
  1204. {
  1205. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1206. "krb5_auth_con_free() fails.\n");
  1207. goto err;
  1208. }
  1209. else krb5auth_context = NULL;
  1210. if (!krb5auth_context &&
  1211. (krb5rc = krb5_auth_con_init(krb5context, &krb5auth_context)))
  1212. {
  1213. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1214. "krb5_auth_con_init() fails.\n");
  1215. goto err;
  1216. }
  1217. if ((krb5rc = krb5_auth_con_getrcache(krb5context, krb5auth_context,
  1218. &rcache)))
  1219. {
  1220. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1221. "krb5_auth_con_getrcache() fails.\n");
  1222. goto err;
  1223. }
  1224. if ((krb5rc = krb5_sname_to_principal(krb5context, NULL,
  1225. (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC,
  1226. KRB5_NT_SRV_HST, &krb5server)) != 0)
  1227. {
  1228. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1229. "krb5_sname_to_principal() fails.\n");
  1230. goto err;
  1231. }
  1232. if (rcache == NULL)
  1233. {
  1234. if ((krb5rc = krb5_get_server_rcache(krb5context,
  1235. krb5_princ_component(krb5context, krb5server, 0),
  1236. &rcache)))
  1237. {
  1238. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1239. "krb5_get_server_rcache() fails.\n");
  1240. goto err;
  1241. }
  1242. }
  1243. if ((krb5rc = krb5_auth_con_setrcache(krb5context, krb5auth_context, rcache)))
  1244. {
  1245. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1246. "krb5_auth_con_setrcache() fails.\n");
  1247. goto err;
  1248. }
  1249. /* kssl_ctx->keytab_file == NULL ==> use Kerberos default
  1250. */
  1251. if (kssl_ctx->keytab_file)
  1252. {
  1253. krb5rc = krb5_kt_resolve(krb5context, kssl_ctx->keytab_file,
  1254. &krb5keytab);
  1255. if (krb5rc)
  1256. {
  1257. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1258. "krb5_kt_resolve() fails.\n");
  1259. goto err;
  1260. }
  1261. }
  1262. else
  1263. {
  1264. krb5rc = krb5_kt_default(krb5context,&krb5keytab);
  1265. if (krb5rc)
  1266. {
  1267. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1268. "krb5_kt_default() fails.\n");
  1269. goto err;
  1270. }
  1271. }
  1272. /* Actual Kerberos5 krb5_recvauth() has initial conversation here
  1273. ** o check KRB5_SENDAUTH_BADAUTHVERS
  1274. ** unless KRB5_RECVAUTH_SKIP_VERSION
  1275. ** o check KRB5_SENDAUTH_BADAPPLVERS
  1276. ** o send "0" msg if all OK
  1277. */
  1278. /* 20010411 was using AP_REQ instead of true KerberosWrapper
  1279. **
  1280. ** if ((krb5rc = krb5_rd_req(krb5context, &krb5auth_context,
  1281. ** &krb5in_data, krb5server, krb5keytab,
  1282. ** &ap_option, &krb5ticket)) != 0) { Error }
  1283. */
  1284. p = (unsigned char *)indata->data;
  1285. if ((asn1ticket = (KRB5_TKTBODY *) d2i_KRB5_TICKET(NULL, &p,
  1286. (long) indata->length)) == NULL)
  1287. {
  1288. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1289. "d2i_KRB5_TICKET() ASN.1 decode failure.\n");
  1290. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1291. goto err;
  1292. }
  1293. /* Was: krb5rc = krb5_decode_ticket(krb5in_data,&krb5ticket)) != 0) */
  1294. if ((krb5rc = kssl_TKT2tkt(krb5context, asn1ticket, &krb5ticket,
  1295. kssl_err)) != 0)
  1296. {
  1297. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1298. "Error converting ASN.1 ticket to krb5_ticket.\n");
  1299. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1300. goto err;
  1301. }
  1302. if (! krb5_principal_compare(krb5context, krb5server,
  1303. krb5ticket->server)) {
  1304. krb5rc = KRB5_PRINC_NOMATCH;
  1305. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1306. "server principal != ticket principal\n");
  1307. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1308. goto err;
  1309. }
  1310. if ((krb5rc = krb5_kt_get_entry(krb5context, krb5keytab,
  1311. krb5ticket->server, krb5ticket->enc_part.kvno,
  1312. krb5ticket->enc_part.enctype, &kt_entry)) != 0) {
  1313. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1314. "krb5_kt_get_entry() fails with %x.\n", krb5rc);
  1315. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1316. goto err;
  1317. }
  1318. if ((krb5rc = krb5_decrypt_tkt_part(krb5context, &kt_entry.key,
  1319. krb5ticket)) != 0) {
  1320. BIO_snprintf(kssl_err->text, KSSL_ERR_MAX,
  1321. "krb5_decrypt_tkt_part() failed.\n");
  1322. kssl_err->reason = SSL_R_KRB5_S_RD_REQ;
  1323. goto err;
  1324. }
  1325. else {
  1326. krb5_kt_free_entry(krb5context, &kt_entry);
  1327. #ifdef KSSL_DEBUG
  1328. {
  1329. int i; krb5_address **paddr = krb5ticket->enc_part2->caddrs;
  1330. printf("Decrypted ticket fields:\n");
  1331. printf("\tflags: %X, transit-type: %X",
  1332. krb5ticket->enc_part2->flags,
  1333. krb5ticket->enc_part2->transited.tr_type);
  1334. print_krb5_data("\ttransit-data: ",
  1335. &(krb5ticket->enc_part2->transited.tr_contents));
  1336. printf("\tcaddrs: %p, authdata: %p\n",
  1337. krb5ticket->enc_part2->caddrs,
  1338. krb5ticket->enc_part2->authorization_data);
  1339. if (paddr)
  1340. {
  1341. printf("\tcaddrs:\n");
  1342. for (i=0; paddr[i] != NULL; i++)
  1343. {
  1344. krb5_data d;
  1345. d.length=paddr[i]->length;
  1346. d.data=paddr[i]->contents;
  1347. print_krb5_data("\t\tIP: ", &d);
  1348. }
  1349. }
  1350. printf("\tstart/auth/end times: %d / %d / %d\n",
  1351. krb5ticket->enc_part2->times.starttime,
  1352. krb5ticket->enc_part2->times.authtime,
  1353. krb5ticket->enc_part2->times.endtime);
  1354. }
  1355. #endif /* KSSL_DEBUG */
  1356. }
  1357. krb5rc = KRB5_NO_TKT_SUPPLIED;
  1358. if (!krb5ticket || !krb5ticket->enc_part2 ||
  1359. !krb5ticket->enc_part2->client ||
  1360. !krb5ticket->enc_part2->client->data ||
  1361. !krb5ticket->enc_part2->session)
  1362. {
  1363. kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
  1364. "bad ticket from krb5_rd_req.\n");
  1365. }
  1366. else if (kssl_ctx_setprinc(kssl_ctx, KSSL_CLIENT,
  1367. &krb5ticket->enc_part2->client->realm,
  1368. krb5ticket->enc_part2->client->data,
  1369. krb5ticket->enc_part2->client->length))
  1370. {
  1371. kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
  1372. "kssl_ctx_setprinc() fails.\n");
  1373. }
  1374. else if (kssl_ctx_setkey(kssl_ctx, krb5ticket->enc_part2->session))
  1375. {
  1376. kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
  1377. "kssl_ctx_setkey() fails.\n");
  1378. }
  1379. else if (krb5ticket->enc_part2->flags & TKT_FLG_INVALID)
  1380. {
  1381. krb5rc = KRB5KRB_AP_ERR_TKT_INVALID;
  1382. kssl_err_set(kssl_err, SSL_R_KRB5_S_BAD_TICKET,
  1383. "invalid ticket from krb5_rd_req.\n");
  1384. }
  1385. else krb5rc = 0;
  1386. kssl_ctx->enctype = krb5ticket->enc_part.enctype;
  1387. ttimes->authtime = krb5ticket->enc_part2->times.authtime;
  1388. ttimes->starttime = krb5ticket->enc_part2->times.starttime;
  1389. ttimes->endtime = krb5ticket->enc_part2->times.endtime;
  1390. ttimes->renew_till = krb5ticket->enc_part2->times.renew_till;
  1391. err:
  1392. #ifdef KSSL_DEBUG
  1393. kssl_ctx_show(kssl_ctx);
  1394. #endif /* KSSL_DEBUG */
  1395. if (asn1ticket) KRB5_TICKET_free((KRB5_TICKET *) asn1ticket);
  1396. if (krb5keytab) krb5_kt_close(krb5context, krb5keytab);
  1397. if (krb5ticket) krb5_free_ticket(krb5context, krb5ticket);
  1398. if (krb5server) krb5_free_principal(krb5context, krb5server);
  1399. return (krb5rc);
  1400. }
  1401. /* Allocate & return a new kssl_ctx struct.
  1402. */
  1403. KSSL_CTX *
  1404. kssl_ctx_new(void)
  1405. {
  1406. return ((KSSL_CTX *) kssl_calloc(1, sizeof(KSSL_CTX)));
  1407. }
  1408. /* Frees a kssl_ctx struct and any allocated memory it holds.
  1409. ** Returns NULL.
  1410. */
  1411. KSSL_CTX *
  1412. kssl_ctx_free(KSSL_CTX *kssl_ctx)
  1413. {
  1414. if (kssl_ctx == NULL) return kssl_ctx;
  1415. if (kssl_ctx->key) OPENSSL_cleanse(kssl_ctx->key,
  1416. kssl_ctx->length);
  1417. if (kssl_ctx->key) kssl_free(kssl_ctx->key);
  1418. if (kssl_ctx->client_princ) kssl_free(kssl_ctx->client_princ);
  1419. if (kssl_ctx->service_host) kssl_free(kssl_ctx->service_host);
  1420. if (kssl_ctx->service_name) kssl_free(kssl_ctx->service_name);
  1421. if (kssl_ctx->keytab_file) kssl_free(kssl_ctx->keytab_file);
  1422. kssl_free(kssl_ctx);
  1423. return (KSSL_CTX *) NULL;
  1424. }
  1425. /* Given an array of (krb5_data *) entity (and optional realm),
  1426. ** set the plain (char *) client_princ or service_host member
  1427. ** of the kssl_ctx struct.
  1428. */
  1429. krb5_error_code
  1430. kssl_ctx_setprinc(KSSL_CTX *kssl_ctx, int which,
  1431. krb5_data *realm, krb5_data *entity, int nentities)
  1432. {
  1433. char **princ;
  1434. int length;
  1435. int i;
  1436. if (kssl_ctx == NULL || entity == NULL) return KSSL_CTX_ERR;
  1437. switch (which)
  1438. {
  1439. case KSSL_CLIENT: princ = &kssl_ctx->client_princ; break;
  1440. case KSSL_SERVER: princ = &kssl_ctx->service_host; break;
  1441. default: return KSSL_CTX_ERR; break;
  1442. }
  1443. if (*princ) kssl_free(*princ);
  1444. /* Add up all the entity->lengths */
  1445. length = 0;
  1446. for (i=0; i < nentities; i++)
  1447. {
  1448. length += entity[i].length;
  1449. }
  1450. /* Add in space for the '/' character(s) (if any) */
  1451. length += nentities-1;
  1452. /* Space for the ('@'+realm+NULL | NULL) */
  1453. length += ((realm)? realm->length + 2: 1);
  1454. if ((*princ = kssl_calloc(1, length)) == NULL)
  1455. return KSSL_CTX_ERR;
  1456. else
  1457. {
  1458. for (i = 0; i < nentities; i++)
  1459. {
  1460. strncat(*princ, entity[i].data, entity[i].length);
  1461. if (i < nentities-1)
  1462. {
  1463. strcat (*princ, "/");
  1464. }
  1465. }
  1466. if (realm)
  1467. {
  1468. strcat (*princ, "@");
  1469. (void) strncat(*princ, realm->data, realm->length);
  1470. }
  1471. }
  1472. return KSSL_CTX_OK;
  1473. }
  1474. /* Set one of the plain (char *) string members of the kssl_ctx struct.
  1475. ** Default values should be:
  1476. ** which == KSSL_SERVICE => "khost" (KRB5SVC)
  1477. ** which == KSSL_KEYTAB => "/etc/krb5.keytab" (KRB5KEYTAB)
  1478. */
  1479. krb5_error_code
  1480. kssl_ctx_setstring(KSSL_CTX *kssl_ctx, int which, char *text)
  1481. {
  1482. char **string;
  1483. if (!kssl_ctx) return KSSL_CTX_ERR;
  1484. switch (which)
  1485. {
  1486. case KSSL_SERVICE: string = &kssl_ctx->service_name; break;
  1487. case KSSL_SERVER: string = &kssl_ctx->service_host; break;
  1488. case KSSL_CLIENT: string = &kssl_ctx->client_princ; break;
  1489. case KSSL_KEYTAB: string = &kssl_ctx->keytab_file; break;
  1490. default: return KSSL_CTX_ERR; break;
  1491. }
  1492. if (*string) kssl_free(*string);
  1493. if (!text)
  1494. {
  1495. *string = '\0';
  1496. return KSSL_CTX_OK;
  1497. }
  1498. if ((*string = kssl_calloc(1, strlen(text) + 1)) == NULL)
  1499. return KSSL_CTX_ERR;
  1500. else
  1501. strcpy(*string, text);
  1502. return KSSL_CTX_OK;
  1503. }
  1504. /* Copy the Kerberos session key from a (krb5_keyblock *) to a kssl_ctx
  1505. ** struct. Clear kssl_ctx->key if Kerberos session key is NULL.
  1506. */
  1507. krb5_error_code
  1508. kssl_ctx_setkey(KSSL_CTX *kssl_ctx, krb5_keyblock *session)
  1509. {
  1510. int length;
  1511. krb5_enctype enctype;
  1512. krb5_octet FAR *contents = NULL;
  1513. if (!kssl_ctx) return KSSL_CTX_ERR;
  1514. if (kssl_ctx->key)
  1515. {
  1516. OPENSSL_cleanse(kssl_ctx->key, kssl_ctx->length);
  1517. kssl_free(kssl_ctx->key);
  1518. }
  1519. if (session)
  1520. {
  1521. #ifdef KRB5_HEIMDAL
  1522. length = session->keyvalue->length;
  1523. enctype = session->keytype;
  1524. contents = session->keyvalue->contents;
  1525. #else
  1526. length = session->length;
  1527. enctype = session->enctype;
  1528. contents = session->contents;
  1529. #endif
  1530. kssl_ctx->enctype = enctype;
  1531. kssl_ctx->length = length;
  1532. }
  1533. else
  1534. {
  1535. kssl_ctx->enctype = ENCTYPE_UNKNOWN;
  1536. kssl_ctx->length = 0;
  1537. return KSSL_CTX_OK;
  1538. }
  1539. if ((kssl_ctx->key =
  1540. (krb5_octet FAR *) kssl_calloc(1, kssl_ctx->length)) == NULL)
  1541. {
  1542. kssl_ctx->length = 0;
  1543. return KSSL_CTX_ERR;
  1544. }
  1545. else
  1546. memcpy(kssl_ctx->key, contents, length);
  1547. return KSSL_CTX_OK;
  1548. }
  1549. /* Display contents of kssl_ctx struct
  1550. */
  1551. void
  1552. kssl_ctx_show(KSSL_CTX *kssl_ctx)
  1553. {
  1554. int i;
  1555. printf("kssl_ctx: ");
  1556. if (kssl_ctx == NULL)
  1557. {
  1558. printf("NULL\n");
  1559. return;
  1560. }
  1561. else
  1562. printf("%p\n", (void *)kssl_ctx);
  1563. printf("\tservice:\t%s\n",
  1564. (kssl_ctx->service_name)? kssl_ctx->service_name: "NULL");
  1565. printf("\tclient:\t%s\n",
  1566. (kssl_ctx->client_princ)? kssl_ctx->client_princ: "NULL");
  1567. printf("\tserver:\t%s\n",
  1568. (kssl_ctx->service_host)? kssl_ctx->service_host: "NULL");
  1569. printf("\tkeytab:\t%s\n",
  1570. (kssl_ctx->keytab_file)? kssl_ctx->keytab_file: "NULL");
  1571. printf("\tkey [%d:%d]:\t",
  1572. kssl_ctx->enctype, kssl_ctx->length);
  1573. for (i=0; i < kssl_ctx->length && kssl_ctx->key; i++)
  1574. {
  1575. printf("%02x", kssl_ctx->key[i]);
  1576. }
  1577. printf("\n");
  1578. return;
  1579. }
  1580. int
  1581. kssl_keytab_is_available(KSSL_CTX *kssl_ctx)
  1582. {
  1583. krb5_context krb5context = NULL;
  1584. krb5_keytab krb5keytab = NULL;
  1585. krb5_keytab_entry entry;
  1586. krb5_principal princ = NULL;
  1587. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  1588. int rc = 0;
  1589. if ((krb5rc = krb5_init_context(&krb5context)))
  1590. return(0);
  1591. /* kssl_ctx->keytab_file == NULL ==> use Kerberos default
  1592. */
  1593. if (kssl_ctx->keytab_file)
  1594. {
  1595. krb5rc = krb5_kt_resolve(krb5context, kssl_ctx->keytab_file,
  1596. &krb5keytab);
  1597. if (krb5rc)
  1598. goto exit;
  1599. }
  1600. else
  1601. {
  1602. krb5rc = krb5_kt_default(krb5context,&krb5keytab);
  1603. if (krb5rc)
  1604. goto exit;
  1605. }
  1606. /* the host key we are looking for */
  1607. krb5rc = krb5_sname_to_principal(krb5context, NULL,
  1608. kssl_ctx->service_name ? kssl_ctx->service_name: KRB5SVC,
  1609. KRB5_NT_SRV_HST, &princ);
  1610. if (krb5rc)
  1611. goto exit;
  1612. krb5rc = krb5_kt_get_entry(krb5context, krb5keytab,
  1613. princ,
  1614. 0 /* IGNORE_VNO */,
  1615. 0 /* IGNORE_ENCTYPE */,
  1616. &entry);
  1617. if ( krb5rc == KRB5_KT_NOTFOUND ) {
  1618. rc = 1;
  1619. goto exit;
  1620. } else if ( krb5rc )
  1621. goto exit;
  1622. krb5_kt_free_entry(krb5context, &entry);
  1623. rc = 1;
  1624. exit:
  1625. if (krb5keytab) krb5_kt_close(krb5context, krb5keytab);
  1626. if (princ) krb5_free_principal(krb5context, princ);
  1627. if (krb5context) krb5_free_context(krb5context);
  1628. return(rc);
  1629. }
  1630. int
  1631. kssl_tgt_is_available(KSSL_CTX *kssl_ctx)
  1632. {
  1633. krb5_error_code krb5rc = KRB5KRB_ERR_GENERIC;
  1634. krb5_context krb5context = NULL;
  1635. krb5_ccache krb5ccdef = NULL;
  1636. krb5_creds krb5creds, *krb5credsp = NULL;
  1637. int rc = 0;
  1638. memset((char *)&krb5creds, 0, sizeof(krb5creds));
  1639. if (!kssl_ctx)
  1640. return(0);
  1641. if (!kssl_ctx->service_host)
  1642. return(0);
  1643. if ((krb5rc = krb5_init_context(&krb5context)) != 0)
  1644. goto err;
  1645. if ((krb5rc = krb5_sname_to_principal(krb5context,
  1646. kssl_ctx->service_host,
  1647. (kssl_ctx->service_name)? kssl_ctx->service_name: KRB5SVC,
  1648. KRB5_NT_SRV_HST, &krb5creds.server)) != 0)
  1649. goto err;
  1650. if ((krb5rc = krb5_cc_default(krb5context, &krb5ccdef)) != 0)
  1651. goto err;
  1652. if ((krb5rc = krb5_cc_get_principal(krb5context, krb5ccdef,
  1653. &krb5creds.client)) != 0)
  1654. goto err;
  1655. if ((krb5rc = krb5_get_credentials(krb5context, 0, krb5ccdef,
  1656. &krb5creds, &krb5credsp)) != 0)
  1657. goto err;
  1658. rc = 1;
  1659. err:
  1660. #ifdef KSSL_DEBUG
  1661. kssl_ctx_show(kssl_ctx);
  1662. #endif /* KSSL_DEBUG */
  1663. if (krb5creds.client) krb5_free_principal(krb5context, krb5creds.client);
  1664. if (krb5creds.server) krb5_free_principal(krb5context, krb5creds.server);
  1665. if (krb5context) krb5_free_context(krb5context);
  1666. return(rc);
  1667. }
  1668. #if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_WIN32)
  1669. void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data)
  1670. {
  1671. #ifdef KRB5_HEIMDAL
  1672. data->length = 0;
  1673. if (data->data)
  1674. free(data->data);
  1675. #elif defined(KRB5_MIT_OLD11)
  1676. if (data->data) {
  1677. krb5_xfree(data->data);
  1678. data->data = 0;
  1679. }
  1680. #else
  1681. krb5_free_data_contents(NULL, data);
  1682. #endif
  1683. }
  1684. #endif /* !OPENSSL_SYS_WINDOWS && !OPENSSL_SYS_WIN32 */
  1685. /* Given pointers to KerberosTime and struct tm structs, convert the
  1686. ** KerberosTime string to struct tm. Note that KerberosTime is a
  1687. ** ASN1_GENERALIZEDTIME value, constrained to GMT with no fractional
  1688. ** seconds as defined in RFC 1510.
  1689. ** Return pointer to the (partially) filled in struct tm on success,
  1690. ** return NULL on failure.
  1691. */
  1692. static struct tm *k_gmtime(ASN1_GENERALIZEDTIME *gtime, struct tm *k_tm)
  1693. {
  1694. char c, *p;
  1695. if (!k_tm) return NULL;
  1696. if (gtime == NULL || gtime->length < 14) return NULL;
  1697. if (gtime->data == NULL) return NULL;
  1698. p = (char *)&gtime->data[14];
  1699. c = *p; *p = '\0'; p -= 2; k_tm->tm_sec = atoi(p); *(p+2) = c;
  1700. c = *p; *p = '\0'; p -= 2; k_tm->tm_min = atoi(p); *(p+2) = c;
  1701. c = *p; *p = '\0'; p -= 2; k_tm->tm_hour = atoi(p); *(p+2) = c;
  1702. c = *p; *p = '\0'; p -= 2; k_tm->tm_mday = atoi(p); *(p+2) = c;
  1703. c = *p; *p = '\0'; p -= 2; k_tm->tm_mon = atoi(p)-1; *(p+2) = c;
  1704. c = *p; *p = '\0'; p -= 4; k_tm->tm_year = atoi(p)-1900; *(p+4) = c;
  1705. return k_tm;
  1706. }
  1707. /* Helper function for kssl_validate_times().
  1708. ** We need context->clockskew, but krb5_context is an opaque struct.
  1709. ** So we try to sneek the clockskew out through the replay cache.
  1710. ** If that fails just return a likely default (300 seconds).
  1711. */
  1712. static krb5_deltat get_rc_clockskew(krb5_context context)
  1713. {
  1714. krb5_rcache rc;
  1715. krb5_deltat clockskew;
  1716. if (krb5_rc_default(context, &rc)) return KSSL_CLOCKSKEW;
  1717. if (krb5_rc_initialize(context, rc, 0)) return KSSL_CLOCKSKEW;
  1718. if (krb5_rc_get_lifespan(context, rc, &clockskew)) {
  1719. clockskew = KSSL_CLOCKSKEW;
  1720. }
  1721. (void) krb5_rc_destroy(context, rc);
  1722. return clockskew;
  1723. }
  1724. /* kssl_validate_times() combines (and more importantly exposes)
  1725. ** the MIT KRB5 internal function krb5_validate_times() and the
  1726. ** in_clock_skew() macro. The authenticator client time is checked
  1727. ** to be within clockskew secs of the current time and the current
  1728. ** time is checked to be within the ticket start and expire times.
  1729. ** Either check may be omitted by supplying a NULL value.
  1730. ** Returns 0 for valid times, SSL_R_KRB5* error codes otherwise.
  1731. ** See Also: (Kerberos source)/krb5/lib/krb5/krb/valid_times.c
  1732. ** 20010420 VRS
  1733. */
  1734. krb5_error_code kssl_validate_times( krb5_timestamp atime,
  1735. krb5_ticket_times *ttimes)
  1736. {
  1737. krb5_deltat skew;
  1738. krb5_timestamp start, now;
  1739. krb5_error_code rc;
  1740. krb5_context context;
  1741. if ((rc = krb5_init_context(&context))) return SSL_R_KRB5_S_BAD_TICKET;
  1742. skew = get_rc_clockskew(context);
  1743. if ((rc = krb5_timeofday(context,&now))) return SSL_R_KRB5_S_BAD_TICKET;
  1744. krb5_free_context(context);
  1745. if (atime && labs(atime - now) >= skew) return SSL_R_KRB5_S_TKT_SKEW;
  1746. if (! ttimes) return 0;
  1747. start = (ttimes->starttime != 0)? ttimes->starttime: ttimes->authtime;
  1748. if (start - now > skew) return SSL_R_KRB5_S_TKT_NYV;
  1749. if ((now - ttimes->endtime) > skew) return SSL_R_KRB5_S_TKT_EXPIRED;
  1750. #ifdef KSSL_DEBUG
  1751. printf("kssl_validate_times: %d |<- | %d - %d | < %d ->| %d\n",
  1752. start, atime, now, skew, ttimes->endtime);
  1753. #endif /* KSSL_DEBUG */
  1754. return 0;
  1755. }
  1756. /* Decode and decrypt given DER-encoded authenticator, then pass
  1757. ** authenticator ctime back in *atimep (or 0 if time unavailable).
  1758. ** Returns krb5_error_code and kssl_err on error. A NULL
  1759. ** authenticator (authentp->length == 0) is not considered an error.
  1760. ** Note that kssl_check_authent() makes use of the KRB5 session key;
  1761. ** you must call kssl_sget_tkt() to get the key before calling this routine.
  1762. */
  1763. krb5_error_code kssl_check_authent(
  1764. /* IN */ KSSL_CTX *kssl_ctx,
  1765. /* IN */ krb5_data *authentp,
  1766. /* OUT */ krb5_timestamp *atimep,
  1767. /* OUT */ KSSL_ERR *kssl_err )
  1768. {
  1769. krb5_error_code krb5rc = 0;
  1770. KRB5_ENCDATA *dec_authent = NULL;
  1771. KRB5_AUTHENTBODY *auth = NULL;
  1772. krb5_enctype enctype;
  1773. EVP_CIPHER_CTX ciph_ctx;
  1774. const EVP_CIPHER *enc = NULL;
  1775. unsigned char iv[EVP_MAX_IV_LENGTH];
  1776. const unsigned char *p;
  1777. unsigned char *unenc_authent;
  1778. int outl, unencbufsize;
  1779. struct tm tm_time, *tm_l, *tm_g;
  1780. time_t now, tl, tg, tr, tz_offset;
  1781. EVP_CIPHER_CTX_init(&ciph_ctx);
  1782. *atimep = 0;
  1783. kssl_err_set(kssl_err, 0, "");
  1784. #ifndef KRB5CHECKAUTH
  1785. authentp = NULL;
  1786. #else
  1787. #if KRB5CHECKAUTH == 0
  1788. authentp = NULL;
  1789. #endif
  1790. #endif /* KRB5CHECKAUTH */
  1791. if (authentp == NULL || authentp->length == 0) return 0;
  1792. #ifdef KSSL_DEBUG
  1793. {
  1794. unsigned int ui;
  1795. printf("kssl_check_authent: authenticator[%d]:\n",authentp->length);
  1796. p = authentp->data;
  1797. for (ui=0; ui < authentp->length; ui++) printf("%02x ",p[ui]);
  1798. printf("\n");
  1799. }
  1800. #endif /* KSSL_DEBUG */
  1801. unencbufsize = 2 * authentp->length;
  1802. if ((unenc_authent = calloc(1, unencbufsize)) == NULL)
  1803. {
  1804. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1805. "Unable to allocate authenticator buffer.\n");
  1806. krb5rc = KRB5KRB_ERR_GENERIC;
  1807. goto err;
  1808. }
  1809. p = (unsigned char *)authentp->data;
  1810. if ((dec_authent = d2i_KRB5_ENCDATA(NULL, &p,
  1811. (long) authentp->length)) == NULL)
  1812. {
  1813. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1814. "Error decoding authenticator.\n");
  1815. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1816. goto err;
  1817. }
  1818. enctype = dec_authent->etype->data[0]; /* should = kssl_ctx->enctype */
  1819. #if !defined(KRB5_MIT_OLD11)
  1820. switch ( enctype ) {
  1821. case ENCTYPE_DES3_CBC_SHA1: /* EVP_des_ede3_cbc(); */
  1822. case ENCTYPE_DES3_CBC_SHA:
  1823. case ENCTYPE_DES3_CBC_RAW:
  1824. krb5rc = 0; /* Skip, can't handle derived keys */
  1825. goto err;
  1826. }
  1827. #endif
  1828. enc = kssl_map_enc(enctype);
  1829. memset(iv, 0, sizeof iv); /* per RFC 1510 */
  1830. if (enc == NULL)
  1831. {
  1832. /* Disable kssl_check_authent for ENCTYPE_DES3_CBC_SHA1.
  1833. ** This enctype indicates the authenticator was encrypted
  1834. ** using key-usage derived keys which openssl cannot decrypt.
  1835. */
  1836. goto err;
  1837. }
  1838. if (!EVP_CipherInit(&ciph_ctx,enc,kssl_ctx->key,iv,0))
  1839. {
  1840. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1841. "EVP_CipherInit error decrypting authenticator.\n");
  1842. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1843. goto err;
  1844. }
  1845. outl = dec_authent->cipher->length;
  1846. if (!EVP_Cipher(&ciph_ctx,unenc_authent,dec_authent->cipher->data,outl))
  1847. {
  1848. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1849. "EVP_Cipher error decrypting authenticator.\n");
  1850. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1851. goto err;
  1852. }
  1853. EVP_CIPHER_CTX_cleanup(&ciph_ctx);
  1854. #ifdef KSSL_DEBUG
  1855. printf("kssl_check_authent: decrypted authenticator[%d] =\n", outl);
  1856. for (padl=0; padl < outl; padl++) printf("%02x ",unenc_authent[padl]);
  1857. printf("\n");
  1858. #endif /* KSSL_DEBUG */
  1859. if ((p = kssl_skip_confound(enctype, unenc_authent)) == NULL)
  1860. {
  1861. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1862. "confounded by authenticator.\n");
  1863. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1864. goto err;
  1865. }
  1866. outl -= p - unenc_authent;
  1867. if ((auth = (KRB5_AUTHENTBODY *) d2i_KRB5_AUTHENT(NULL, &p,
  1868. (long) outl))==NULL)
  1869. {
  1870. kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
  1871. "Error decoding authenticator body.\n");
  1872. krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
  1873. goto err;
  1874. }
  1875. memset(&tm_time,0,sizeof(struct tm));
  1876. if (k_gmtime(auth->ctime, &tm_time) &&
  1877. ((tr = mktime(&tm_time)) != (time_t)(-1)))
  1878. {
  1879. now = time(&now);
  1880. tm_l = localtime(&now); tl = mktime(tm_l);
  1881. tm_g = gmtime(&now); tg = mktime(tm_g);
  1882. tz_offset = tg - tl;
  1883. *atimep = (krb5_timestamp)(tr - tz_offset);
  1884. }
  1885. #ifdef KSSL_DEBUG
  1886. printf("kssl_check_authent: returns %d for client time ", *atimep);
  1887. if (auth && auth->ctime && auth->ctime->length && auth->ctime->data)
  1888. printf("%.*s\n", auth->ctime->length, auth->ctime->data);
  1889. else printf("NULL\n");
  1890. #endif /* KSSL_DEBUG */
  1891. err:
  1892. if (auth) KRB5_AUTHENT_free((KRB5_AUTHENT *) auth);
  1893. if (dec_authent) KRB5_ENCDATA_free(dec_authent);
  1894. if (unenc_authent) free(unenc_authent);
  1895. EVP_CIPHER_CTX_cleanup(&ciph_ctx);
  1896. return krb5rc;
  1897. }
  1898. /* Replaces krb5_build_principal_ext(), with varargs length == 2 (svc, host),
  1899. ** because I dont't know how to stub varargs.
  1900. ** Returns krb5_error_code == ENOMEM on alloc error, otherwise
  1901. ** passes back newly constructed principal, which should be freed by caller.
  1902. */
  1903. krb5_error_code kssl_build_principal_2(
  1904. /* UPDATE */ krb5_context context,
  1905. /* OUT */ krb5_principal *princ,
  1906. /* IN */ int rlen, const char *realm,
  1907. /* IN */ int slen, const char *svc,
  1908. /* IN */ int hlen, const char *host)
  1909. {
  1910. krb5_data *p_data = NULL;
  1911. krb5_principal new_p = NULL;
  1912. char *new_r = NULL;
  1913. if ((p_data = (krb5_data *) calloc(2, sizeof(krb5_data))) == NULL ||
  1914. (new_p = (krb5_principal) calloc(1, sizeof(krb5_principal_data)))
  1915. == NULL) goto err;
  1916. new_p->length = 2;
  1917. new_p->data = p_data;
  1918. if ((new_r = calloc(1, rlen + 1)) == NULL) goto err;
  1919. memcpy(new_r, realm, rlen);
  1920. krb5_princ_set_realm_length(context, new_p, rlen);
  1921. krb5_princ_set_realm_data(context, new_p, new_r);
  1922. if ((new_p->data[0].data = calloc(1, slen + 1)) == NULL) goto err;
  1923. memcpy(new_p->data[0].data, svc, slen);
  1924. new_p->data[0].length = slen;
  1925. if ((new_p->data[1].data = calloc(1, hlen + 1)) == NULL) goto err;
  1926. memcpy(new_p->data[1].data, host, hlen);
  1927. new_p->data[1].length = hlen;
  1928. krb5_princ_type(context, new_p) = KRB5_NT_UNKNOWN;
  1929. *princ = new_p;
  1930. return 0;
  1931. err:
  1932. if (new_p && new_p[0].data) free(new_p[0].data);
  1933. if (new_p && new_p[1].data) free(new_p[1].data);
  1934. if (new_p) free(new_p);
  1935. if (new_r) free(new_r);
  1936. return ENOMEM;
  1937. }
  1938. #else /* !OPENSSL_NO_KRB5 */
  1939. #if defined(PEDANTIC) || defined(OPENSSL_SYS_VMS)
  1940. static void *dummy=&dummy;
  1941. #endif
  1942. #endif /* !OPENSSL_NO_KRB5 */