Tryag File Manager
Home
-
Turbo Force
Current Path :
/
proc
/
self
/
root
/
usr
/
share
/
doc
/
pkinit-nss-0.7.6
/
Upload File :
New :
File
Dir
//proc/self/root/usr/share/doc/pkinit-nss-0.7.6/krb5-1.5.1-1.6-pal.patch
diff -upNr krb5-1.5.1 krb5-1.6 --- krb5/src/kdc/dispatch.c +++ krb5/src/kdc/dispatch.c @@ -94,7 +94,7 @@ dispatch(krb5_data *pkt, const krb5_full * pointer. */ if (!(retval = setup_server_realm(as_req->server))) { - retval = process_as_req(as_req, from, response); + retval = process_as_req(as_req, pkt, from, response); } krb5_free_kdc_req(kdc_context, as_req); } --- krb5/src/kdc/Makefile.in +++ krb5/src/kdc/Makefile.in @@ -13,7 +13,7 @@ PROG_LIBPATH=-L$(TOPLIBD) $(KRB4_LIBPATH KDB5_LIB_DEPS=$(DL_LIB) $(THREAD_LINKOPTS) PROG_RPATH=$(KRB5_LIBDIR) FAKEKA=@FAKEKA@ -DEFS= +DEFS=-DLIBDIR=\"$(KRB5_LIBDIR)\" all:: krb5kdc rtest $(FAKEKA) --- krb5/src/kdc/do_as_req.c +++ krb5/src/kdc/do_as_req.c @@ -50,8 +50,8 @@ static krb5_error_code prepare_error_as /*ARGSUSED*/ krb5_error_code -process_as_req(krb5_kdc_req *request, const krb5_fulladdr *from, - krb5_data **response) +process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, + const krb5_fulladdr *from, krb5_data **response) { krb5_db_entry client, server; krb5_kdc_rep reply; @@ -78,6 +78,7 @@ process_as_req(krb5_kdc_req *request, co char ktypestr[128]; char rep_etypestr[128]; char fromstringbuf[70]; + void *pa_context = NULL; ticket_reply.enc_part.ciphertext.data = 0; e_data.data = 0; @@ -260,7 +261,8 @@ process_as_req(krb5_kdc_req *request, co * Check the preauthentication if it is there. */ if (request->padata) { - errcode = check_padata(kdc_context, &client, request, &enc_tkt_reply); + errcode = check_padata(kdc_context, &client, req_pkt, request, + &enc_tkt_reply, &pa_context, &e_data); if (errcode) { #ifdef KRBCONF_KDC_MODIFIES_KDB /* @@ -381,8 +383,8 @@ process_as_req(krb5_kdc_req *request, co reply_encpart.caddrs = enc_tkt_reply.caddrs; /* Fetch the padata info to be returned */ - errcode = return_padata(kdc_context, &client, request, &reply, client_key, - &encrypting_key); + errcode = return_padata(kdc_context, &client, req_pkt, request, + &reply, client_key, &encrypting_key, &pa_context); if (errcode) { status = "KDC_RETURN_PADATA"; goto errout; @@ -427,8 +429,11 @@ process_as_req(krb5_kdc_req *request, co #endif /* KRBCONF_KDC_MODIFIES_KDB */ errout: + if (pa_context) + free_padata_context(kdc_context, &pa_context); + if (status) { - char * emsg = 0; + const char * emsg = 0; if (errcode) emsg = krb5_get_error_message (kdc_context, errcode); --- krb5/src/kdc/kdc_preauth.c +++ krb5/src/kdc/kdc_preauth.c @@ -60,6 +60,13 @@ #include <syslog.h> #include <assert.h> +#include "../include/krb5/preauth_plugin.h" + +#if TARGET_OS_MAC +static const char *objdirs[] = { KRB5_PLUGIN_BUNDLE_DIR, LIBDIR "/krb5/plugins/preauth", NULL }; /* should be a list */ +#else +static const char *objdirs[] = { LIBDIR "/krb5/plugins/preauth", NULL }; +#endif /* XXX This is ugly and should be in a header file somewhere */ #ifndef KRB5INT_DES_TYPES_DEFINED @@ -72,44 +79,76 @@ extern int mit_des_is_weak_key (mit_des_ typedef krb5_error_code (*verify_proc) (krb5_context, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, - krb5_enc_tkt_part * enc_tkt_reply, krb5_pa_data *data); + krb5_enc_tkt_part * enc_tkt_reply, krb5_pa_data *data, + preauth_get_entry_data_proc get_entry_data, + void *pa_module_context, + void **pa_request_context, + krb5_data **e_data); typedef krb5_error_code (*edata_proc) (krb5_context, krb5_kdc_req *request, krb5_db_entry *client, krb5_db_entry *server, + preauth_get_entry_data_proc get_entry_data, + void *pa_module_context, krb5_pa_data *data); typedef krb5_error_code (*return_proc) (krb5_context, krb5_pa_data * padata, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, krb5_keyblock *encrypting_key, - krb5_pa_data **send_pa); + krb5_pa_data **send_pa, + preauth_get_entry_data_proc get_entry_data, + void *pa_module_context, + void **pa_request_context); + +typedef krb5_error_code (*freepa_proc) + (krb5_context, void *pa_module_context, void **pa_request_context); + +typedef krb5_error_code (*init_proc) + (krb5_context, void **); +typedef void (*fini_proc) + (krb5_context, void *); typedef struct _krb5_preauth_systems { - char * name; + const char *name; int type; int flags; + void *plugin_context; + init_proc init; + fini_proc fini; edata_proc get_edata; verify_proc verify_padata; return_proc return_padata; + freepa_proc free_pa_request_context; } krb5_preauth_systems; static krb5_error_code verify_enc_timestamp (krb5_context, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, - krb5_enc_tkt_part * enc_tkt_reply, krb5_pa_data *data); + krb5_enc_tkt_part * enc_tkt_reply, krb5_pa_data *data, + preauth_get_entry_data_proc get_entry_data, + void *pa_system_context, + void **pa_request_context, + krb5_data **e_data); static krb5_error_code get_etype_info (krb5_context, krb5_kdc_req *request, krb5_db_entry *client, krb5_db_entry *server, + preauth_get_entry_data_proc get_entry_data, + void *pa_system_context, krb5_pa_data *data); static krb5_error_code get_etype_info2(krb5_context context, krb5_kdc_req *request, - krb5_db_entry *client, krb5_db_entry *server, - krb5_pa_data *pa_data); + krb5_db_entry *client, krb5_db_entry *server, + preauth_get_entry_data_proc get_entry_data, + void *pa_system_context, + krb5_pa_data *pa_data); static krb5_error_code etype_info_as_rep_helper(krb5_context context, krb5_pa_data * padata, krb5_db_entry *client, @@ -122,58 +161,76 @@ etype_info_as_rep_helper(krb5_context co static krb5_error_code return_etype_info(krb5_context, krb5_pa_data * padata, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, krb5_keyblock *encrypting_key, - krb5_pa_data **send_pa); + krb5_pa_data **send_pa, + preauth_get_entry_data_proc get_entry_data, + void *pa_system_context, + void **pa_request_context); static krb5_error_code return_etype_info2(krb5_context, krb5_pa_data * padata, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, krb5_keyblock *encrypting_key, - krb5_pa_data **send_pa); + krb5_pa_data **send_pa, + preauth_get_entry_data_proc get_entry_data, + void *pa_system_context, + void **pa_request_context); static krb5_error_code return_pw_salt (krb5_context, krb5_pa_data * padata, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, krb5_keyblock *encrypting_key, - krb5_pa_data **send_pa); + krb5_pa_data **send_pa, + preauth_get_entry_data_proc get_entry_data, + void *pa_system_context, + void **pa_request_context); /* SAM preauth support */ static krb5_error_code verify_sam_response (krb5_context, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, - krb5_enc_tkt_part * enc_tkt_reply, krb5_pa_data *data); + krb5_enc_tkt_part * enc_tkt_reply, krb5_pa_data *data, + preauth_get_entry_data_proc get_entry_data, + void *pa_module_context, + void **pa_request_context, + krb5_data **e_data); static krb5_error_code get_sam_edata (krb5_context, krb5_kdc_req *request, krb5_db_entry *client, krb5_db_entry *server, + preauth_get_entry_data_proc get_entry_data, + void *pa_module_context, krb5_pa_data *data); static krb5_error_code return_sam_data (krb5_context, krb5_pa_data * padata, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, krb5_keyblock *encrypting_key, - krb5_pa_data **send_pa); -/* - * Preauth property flags - */ -#define PA_HARDWARE 0x00000001 -#define PA_REQUIRED 0x00000002 -#define PA_SUFFICIENT 0x00000004 - /* Not really a padata, so don't include it in the etype list*/ -#define PA_PSEUDO 0x00000008 + krb5_pa_data **send_pa, + preauth_get_entry_data_proc get_entry_data, + void *pa_module_context, + void **pa_request_context); -static krb5_preauth_systems preauth_systems[] = { +static krb5_preauth_systems static_preauth_systems[] = { { "timestamp", KRB5_PADATA_ENC_TIMESTAMP, 0, + NULL, + NULL, + NULL, 0, verify_enc_timestamp, 0 @@ -182,6 +239,9 @@ static krb5_preauth_systems preauth_syst "etype-info", KRB5_PADATA_ETYPE_INFO, 0, + NULL, + NULL, + NULL, get_etype_info, 0, return_etype_info @@ -190,6 +250,9 @@ static krb5_preauth_systems preauth_syst "etype-info2", KRB5_PADATA_ETYPE_INFO2, 0, + NULL, + NULL, + NULL, get_etype_info2, 0, return_etype_info2 @@ -198,6 +261,9 @@ static krb5_preauth_systems preauth_syst "pw-salt", KRB5_PADATA_PW_SALT, PA_PSEUDO, /* Don't include this in the error list */ + NULL, + NULL, + NULL, 0, 0, return_pw_salt @@ -206,6 +272,9 @@ static krb5_preauth_systems preauth_syst "sam-response", KRB5_PADATA_SAM_RESPONSE, 0, + NULL, + NULL, + NULL, 0, verify_sam_response, return_sam_data @@ -214,6 +283,9 @@ static krb5_preauth_systems preauth_syst "sam-challenge", KRB5_PADATA_SAM_CHALLENGE, PA_HARDWARE, /* causes get_preauth_hint_list to use this */ + NULL, + NULL, + NULL, get_sam_edata, 0, 0 @@ -221,13 +293,378 @@ static krb5_preauth_systems preauth_syst { "[end]", -1,} }; -#define MAX_PREAUTH_SYSTEMS (sizeof(preauth_systems)/sizeof(preauth_systems[0])) +static krb5_preauth_systems *preauth_systems; +static int n_preauth_systems; +static struct plugin_dir_handle preauth_plugins; + +krb5_error_code +load_preauth_plugins(krb5_context context) +{ + struct errinfo err; + void **preauth_plugins_ftables; + struct krb5plugin_preauth_server_ftable_v0 *ftable; + int module_count, i, j, k; + void *plugin_context; + init_proc server_init_proc = NULL; + + memset(&err, 0, sizeof(err)); + + /* Attempt to load all of the preauth plugins we can find. */ + PLUGIN_DIR_INIT(&preauth_plugins); + if (PLUGIN_DIR_OPEN(&preauth_plugins) == 0) { + if (krb5int_open_plugin_dirs(objdirs, NULL, + &preauth_plugins, &err) != 0) { + return KRB5_PLUGIN_NO_HANDLE; + } + } + + /* Get the method tables provided by the loaded plugins. */ + preauth_plugins_ftables = NULL; + if (krb5int_get_plugin_dir_data(&preauth_plugins, + "preauthentication_server_0_backport_1_6", + &preauth_plugins_ftables, &err) != 0) { + return KRB5_PLUGIN_NO_HANDLE; + } + + /* Count the valid modules. */ + module_count = sizeof(static_preauth_systems) + / sizeof(static_preauth_systems[0]); + if (preauth_plugins_ftables != NULL) { + for (i = 0; preauth_plugins_ftables[i] != NULL; i++) { + ftable = preauth_plugins_ftables[i]; + if ((ftable->flags_proc == NULL) && + (ftable->edata_proc == NULL) && + (ftable->verify_proc == NULL) && + (ftable->return_proc == NULL)) { + continue; + } + for (j = 0; + ftable->pa_type_list != NULL && + ftable->pa_type_list[j] > 0; + j++) { + module_count++; + } + } + } + + /* Build the complete list of supported preauthentication options, and + * leave room for a terminator entry. */ + preauth_systems = malloc(sizeof(krb5_preauth_systems) * (module_count + 1)); + if (preauth_systems == NULL) { + krb5int_free_plugin_dir_data(preauth_plugins_ftables); + return ENOMEM; + } + + /* Add the locally-supplied mechanisms to the dynamic list first. */ + for (i = 0, k = 0; + i < sizeof(static_preauth_systems) / sizeof(static_preauth_systems[0]); + i++) { + if (static_preauth_systems[i].type == -1) + break; + preauth_systems[k] = static_preauth_systems[i]; + /* Try to initialize the preauth system. If it fails, we'll remove it + * from the list of systems we'll be using. */ + plugin_context = NULL; + server_init_proc = static_preauth_systems[i].init; + if ((server_init_proc != NULL) && + ((*server_init_proc)(context, &plugin_context) != 0)) { + memset(&preauth_systems[k], 0, sizeof(preauth_systems[k])); + continue; + } + preauth_systems[k].plugin_context = plugin_context; + k++; + } + + /* Now add the dynamically-loaded mechanisms to the list. */ + if (preauth_plugins_ftables != NULL) { + for (i = 0; preauth_plugins_ftables[i] != NULL; i++) { + ftable = preauth_plugins_ftables[i]; + if ((ftable->flags_proc == NULL) && + (ftable->edata_proc == NULL) && + (ftable->verify_proc == NULL) && + (ftable->return_proc == NULL)) { + continue; + } + plugin_context = NULL; + for (j = 0; + ftable->pa_type_list != NULL && + ftable->pa_type_list[j] > 0; + j++) { + /* Try to initialize the plugin. If it fails, we'll remove it + * from the list of modules we'll be using. */ + if (j == 0) { + server_init_proc = ftable->init_proc; + if (server_init_proc != NULL) { + krb5_error_code initerr; + initerr = (*server_init_proc)(context, &plugin_context); + if (initerr) { + const char *emsg; + emsg = krb5_get_error_message(context, initerr); + if (emsg) { + krb5_klog_syslog(LOG_ERR, + "preauth %s failed to initialize: %s", + ftable->name, emsg); + krb5_free_error_message(context, emsg); + } + memset(&preauth_systems[k], 0, sizeof(preauth_systems[k])); + + break; /* skip all modules in this plugin */ + } + } + } + preauth_systems[k].name = ftable->name; + preauth_systems[k].type = ftable->pa_type_list[j]; + if (ftable->flags_proc != NULL) + preauth_systems[k].flags = ftable->flags_proc(context, preauth_systems[k].type); + else + preauth_systems[k].flags = 0; + preauth_systems[k].plugin_context = plugin_context; + preauth_systems[k].init = server_init_proc; + /* Only call fini once for each plugin */ + if (j == 0) + preauth_systems[k].fini = ftable->fini_proc; + else + preauth_systems[k].fini = NULL; + preauth_systems[k].get_edata = ftable->edata_proc; + preauth_systems[k].verify_padata = ftable->verify_proc; + preauth_systems[k].return_padata = ftable->return_proc; + preauth_systems[k].free_pa_request_context = + ftable->freepa_reqcontext_proc; + k++; + } + } + krb5int_free_plugin_dir_data(preauth_plugins_ftables); + } + n_preauth_systems = k; + /* Add the end-of-list marker. */ + preauth_systems[k].name = "[end]"; + preauth_systems[k].type = -1; + return 0; +} + +krb5_error_code +unload_preauth_plugins(krb5_context context) +{ + int i; + if (preauth_systems != NULL) { + for (i = 0; i < n_preauth_systems; i++) { + if (preauth_systems[i].fini != NULL) { + (*preauth_systems[i].fini)(context, + preauth_systems[i].plugin_context); + } + memset(&preauth_systems[i], 0, sizeof(preauth_systems[i])); + } + free(preauth_systems); + preauth_systems = NULL; + n_preauth_systems = 0; + krb5int_close_plugin_dirs(&preauth_plugins); + } + return 0; +} + +/* + * The make_padata_context() function creates a space for storing any context + * information which will be needed by return_padata() later. Each preauth + * type gets a context storage location of its own. + */ +struct request_pa_context { + int n_contexts; + struct { + krb5_preauth_systems *pa_system; + void *pa_context; + } *contexts; +}; + +static krb5_error_code +make_padata_context(krb5_context context, void **padata_context) +{ + int i; + struct request_pa_context *ret; + + ret = malloc(sizeof(*ret)); + if (ret == NULL) { + return ENOMEM; + } + + ret->n_contexts = n_preauth_systems; + ret->contexts = malloc(sizeof(ret->contexts[0]) * ret->n_contexts); + if (ret->contexts == NULL) { + free(ret); + return ENOMEM; + } + + memset(ret->contexts, 0, sizeof(ret->contexts[0]) * ret->n_contexts); + + for (i = 0; i < ret->n_contexts; i++) { + ret->contexts[i].pa_system = &preauth_systems[i]; + ret->contexts[i].pa_context = NULL; + } + + *padata_context = ret; + + return 0; +} + +/* + * The free_padata_context function frees any context information pointers + * which the check_padata() function created but which weren't already cleaned + * up by return_padata(). + */ +krb5_error_code +free_padata_context(krb5_context kcontext, void **padata_context) +{ + struct request_pa_context *context; + krb5_preauth_systems *preauth_system; + void **pctx, *mctx; + int i; + + if (padata_context == NULL) + return 0; + + context = *padata_context; + + for (i = 0; i < context->n_contexts; i++) { + if (context->contexts[i].pa_context != NULL) { + preauth_system = context->contexts[i].pa_system; + mctx = preauth_system->plugin_context; + if (preauth_system->free_pa_request_context != NULL) { + pctx = &context->contexts[i].pa_context; + (*preauth_system->free_pa_request_context)(kcontext, mctx, + pctx); + } + context->contexts[i].pa_context = NULL; + } + } + + free(context->contexts); + free(context); + + return 0; +} + +/* Retrieve a specified tl_data item from the given entry, and return its + * contents in a new krb5_data, which must be freed by the caller. */ +static krb5_error_code +get_entry_tl_data(krb5_context context, krb5_db_entry *entry, + krb5_int16 tl_data_type, krb5_data **result) +{ + krb5_tl_data *tl; + for (tl = entry->tl_data; tl != NULL; tl = tl->tl_data_next) { + if (tl->tl_data_type == tl_data_type) { + *result = malloc(sizeof(krb5_data)); + if (*result == NULL) { + return ENOMEM; + } + (*result)->magic = KV5M_DATA; + (*result)->data = malloc(tl->tl_data_length); + if ((*result)->data == NULL) { + free(*result); + *result = NULL; + return ENOMEM; + } + memcpy((*result)->data, tl->tl_data_contents, tl->tl_data_length); + return 0; + } + } + return ENOENT; +} + +/* + * Retrieve a specific piece of information pertaining to the entry or the + * request and return it in a new krb5_data item which the caller must free. + * + * This may require massaging data into a contrived format, but it will + * hopefully keep us from having to reveal library-internal functions to + * modules. + */ +static krb5_error_code +get_entry_data(krb5_context context, + krb5_kdc_req *request, krb5_db_entry *entry, + krb5_int32 type, + krb5_data **result) +{ + int i, k; + krb5_data *ret; + krb5_deltat *delta; + krb5_keyblock *keys; + krb5_key_data *entry_key; + + switch (type) { + case krb5plugin_preauth_entry_request_certificate: + return get_entry_tl_data(context, entry, + KRB5_TL_USER_CERTIFICATE, result); + break; + case krb5plugin_preauth_entry_max_time_skew: + ret = malloc(sizeof(krb5_data)); + if (ret == NULL) + return ENOMEM; + delta = malloc(sizeof(krb5_deltat)); + if (delta == NULL) { + free(ret); + return ENOMEM; + } + *delta = context->clockskew; + ret->data = (char *) delta; + ret->length = sizeof(*delta); + *result = ret; + return 0; + break; + case krb5plugin_preauth_keys: + ret = malloc(sizeof(krb5_data)); + if (ret == NULL) + return ENOMEM; + keys = malloc(sizeof(krb5_keyblock) * (request->nktypes + 1)); + if (keys == NULL) { + free(ret); + return ENOMEM; + } + ret->data = (char *) keys; + ret->length = sizeof(krb5_keyblock) * (request->nktypes + 1); + memset(ret->data, 0, ret->length); + k = 0; + for (i = 0; i < request->nktypes; i++) { + entry_key = NULL; + if (krb5_dbe_find_enctype(context, entry, request->ktype[i], + -1, 0, &entry_key) != 0) + continue; + if (krb5_dbekd_decrypt_key_data(context, &master_keyblock, + entry_key, &keys[k], NULL) != 0) { + if (keys[k].contents != NULL) + krb5_free_keyblock_contents(context, &keys[k]); + memset(&keys[k], 0, sizeof(keys[k])); + continue; + } + k++; + } + if (k > 0) { + *result = ret; + return 0; + } else { + free(keys); + free(ret); + } + break; + case krb5plugin_preauth_request_body: + ret = NULL; + encode_krb5_kdc_req_body(request, &ret); + if (ret != NULL) { + *result = ret; + return 0; + } + return ASN1_PARSE_ERROR; + break; + default: + break; + } + return ENOENT; +} static krb5_error_code find_pa_system(int type, krb5_preauth_systems **preauth) { - krb5_preauth_systems *ap = preauth_systems; - + krb5_preauth_systems *ap; + + ap = preauth_systems ? preauth_systems : static_preauth_systems; while ((ap->type != -1) && (ap->type != type)) ap++; if (ap->type == -1) @@ -236,6 +673,113 @@ find_pa_system(int type, krb5_preauth_sy return 0; } +static krb5_error_code +find_pa_context(krb5_preauth_systems *pa_sys, + struct request_pa_context *context, + void ***pa_context) +{ + int i; + + *pa_context = 0; + + if (context == NULL) + return KRB5KRB_ERR_GENERIC; + + for (i = 0; i < context->n_contexts; i++) { + if (context->contexts[i].pa_system == pa_sys) { + *pa_context = &context->contexts[i].pa_context; + return 0; + } + } + + return KRB5KRB_ERR_GENERIC; +} + +/* + * Create a list of indices into the preauth_systems array, sorted by order of + * preference. + */ +static krb5_boolean +pa_list_includes(krb5_pa_data **pa_data, krb5_preauthtype pa_type) +{ + while (*pa_data != NULL) { + if ((*pa_data)->pa_type == pa_type) + return TRUE; + pa_data++; + } + return FALSE; +} +static void +sort_pa_order(krb5_context context, krb5_kdc_req *request, int *pa_order) +{ + int i, j, k, n_repliers, n_key_replacers; + + /* First, set up the default order. */ + i = 0; + for (j = 0; j < n_preauth_systems; j++) { + if (preauth_systems[j].return_padata != NULL) + pa_order[i++] = j; + } + n_repliers = i; + pa_order[n_repliers] = -1; + + /* Reorder so that PA_REPLACES_KEY modules are listed first. */ + for (i = 0; i < n_repliers; i++) { + /* If this module replaces the key, then it's okay to leave it where it + * is in the order. */ + if (preauth_systems[pa_order[i]].flags & PA_REPLACES_KEY) + continue; + /* If not, search for a module which does, and swap in the first one we + * find. */ + for (j = i + 1; j < n_repliers; j++) { + if (preauth_systems[pa_order[j]].flags & PA_REPLACES_KEY) { + k = pa_order[j]; + pa_order[j] = pa_order[i]; + pa_order[i] = k; + break; + } + } + } + + if (request->padata != NULL) { + /* Now reorder the subset of modules which replace the key, + * bubbling those which handle pa_data types provided by the + * client ahead of the others. */ + for (i = 0; preauth_systems[pa_order[i]].flags & PA_REPLACES_KEY; i++) { + continue; + } + n_key_replacers = i; + for (i = 0; i < n_key_replacers; i++) { + if (pa_list_includes(request->padata, + preauth_systems[pa_order[i]].type)) + continue; + for (j = i + 1; j < n_key_replacers; j++) { + if (pa_list_includes(request->padata, + preauth_systems[pa_order[j]].type)) { + k = pa_order[j]; + pa_order[j] = pa_order[i]; + pa_order[i] = k; + break; + } + } + } + } +#ifdef DEBUG + krb5_klog_syslog(LOG_DEBUG, "original preauth mechanism list:"); + for (i = 0; i < n_preauth_systems; i++) { + if (preauth_systems[i].return_padata != NULL) + krb5_klog_syslog(LOG_DEBUG, "... %s(%d)", preauth_systems[i].name, + preauth_systems[i].type); + } + krb5_klog_syslog(LOG_DEBUG, "sorted preauth mechanism list:"); + for (i = 0; pa_order[i] != -1; i++) { + krb5_klog_syslog(LOG_DEBUG, "... %s(%d)", + preauth_systems[pa_order[i]].name, + preauth_systems[pa_order[i]].type); + } +#endif +} + const char *missing_required_preauth(krb5_db_entry *client, krb5_db_entry *server, krb5_enc_tkt_part *enc_tkt_reply) @@ -287,10 +831,10 @@ void get_preauth_hint_list(krb5_kdc_req e_data->data = 0; hw_only = isflagset(client->attributes, KRB5_KDB_REQUIRES_HW_AUTH); - pa_data = malloc(sizeof(krb5_pa_data *) * (MAX_PREAUTH_SYSTEMS+1)); + pa_data = malloc(sizeof(krb5_pa_data *) * (n_preauth_systems+1)); if (pa_data == 0) return; - memset(pa_data, 0, sizeof(krb5_pa_data *) * (MAX_PREAUTH_SYSTEMS+1)); + memset(pa_data, 0, sizeof(krb5_pa_data *) * (n_preauth_systems+1)); pa = pa_data; for (ap = preauth_systems; ap->type != -1; ap++) { @@ -305,7 +849,8 @@ void get_preauth_hint_list(krb5_kdc_req (*pa)->magic = KV5M_PA_DATA; (*pa)->pa_type = ap->type; if (ap->get_edata) { - retval = (ap->get_edata)(kdc_context, request, client, server, *pa); + retval = (ap->get_edata)(kdc_context, request, client, server, + get_entry_data, ap->plugin_context, *pa); if (retval) { /* just failed on this type, continue */ free(*pa); @@ -335,23 +880,33 @@ errout: /* * This routine is called to verify the preauthentication information * for a V5 request. - * + * * Returns 0 if the pre-authentication is valid, non-zero to indicate * an error code of some sort. */ krb5_error_code -check_padata (krb5_context context, krb5_db_entry *client, - krb5_kdc_req *request, krb5_enc_tkt_part *enc_tkt_reply) +check_padata (krb5_context context, krb5_db_entry *client, krb5_data *req_pkt, + krb5_kdc_req *request, krb5_enc_tkt_part *enc_tkt_reply, + void **padata_context, krb5_data *e_data) { krb5_error_code retval = 0; krb5_pa_data **padata; krb5_preauth_systems *pa_sys; - int pa_ok = 0, pa_found = 0; + void **pa_context; + krb5_data *pa_e_data = NULL, *tmp_e_data = NULL; + int pa_ok = 0, pa_found = 0; + krb5_error_code saved_retval = 0; + int use_saved_retval = 0; + const char *emsg; if (request->padata == 0) return 0; + if (make_padata_context(context, padata_context) != 0) { + return KRB5KRB_ERR_GENERIC; + } + #ifdef DEBUG krb5_klog_syslog (LOG_DEBUG, "checking padata"); #endif @@ -361,52 +916,128 @@ check_padata (krb5_context context, krb5 #endif if (find_pa_system((*padata)->pa_type, &pa_sys)) continue; + if (find_pa_context(pa_sys, *padata_context, &pa_context)) + continue; #ifdef DEBUG krb5_klog_syslog (LOG_DEBUG, ".. pa_type %s", pa_sys->name); #endif if (pa_sys->verify_padata == 0) continue; pa_found++; - retval = pa_sys->verify_padata(context, client, request, - enc_tkt_reply, *padata); + retval = pa_sys->verify_padata(context, client, req_pkt, request, + enc_tkt_reply, *padata, + get_entry_data, pa_sys->plugin_context, + pa_context, &tmp_e_data); if (retval) { - char * emsg = krb5_get_error_message (context, retval); + emsg = krb5_get_error_message (context, retval); krb5_klog_syslog (LOG_INFO, "preauth (%s) verify failure: %s", pa_sys->name, emsg); krb5_free_error_message (context, emsg); if (pa_sys->flags & PA_REQUIRED) { + /* free up any previous edata we might have been saving */ + if (pa_e_data != NULL) + krb5_free_data(context, pa_e_data); + pa_e_data = tmp_e_data; + tmp_e_data = NULL; + use_saved_retval = 0; /* Make sure we use the current retval */ pa_ok = 0; break; } + /* + * We'll return edata from either the first PA_REQUIRED module + * that fails, or the first non-PA_REQUIRED module that fails. + * Hang on to edata from the first non-PA_REQUIRED module. + * If we've already got one saved, simply discard this one. + */ + if (tmp_e_data != NULL) { + if (pa_e_data == NULL) { + /* save the first error code and e-data */ + pa_e_data = tmp_e_data; + tmp_e_data = NULL; + saved_retval = retval; + use_saved_retval = 1; + } else { + /* discard this extra e-data from non-PA_REQUIRED module */ + krb5_free_data(context, tmp_e_data); + tmp_e_data = NULL; + } + } } else { #ifdef DEBUG krb5_klog_syslog (LOG_DEBUG, ".. .. ok"); #endif + /* Ignore any edata returned on success */ + if (tmp_e_data != NULL) { + krb5_free_data(context, tmp_e_data); + tmp_e_data = NULL; + } pa_ok = 1; - if (pa_sys->flags & PA_SUFFICIENT) + if (pa_sys->flags & PA_SUFFICIENT) break; } } + + /* Don't bother copying and returning e-data on success */ + if (pa_ok && pa_e_data != NULL) { + krb5_free_data(context, pa_e_data); + pa_e_data = NULL; + } + /* Return any e-data from the preauth that caused us to exit the loop */ + if (pa_e_data != NULL) { + e_data->data = malloc(pa_e_data->length); + if (e_data->data == NULL) { + krb5_free_data(context, pa_e_data); + return KRB5KRB_ERR_GENERIC; + } + memcpy(e_data->data, pa_e_data->data, pa_e_data->length); + e_data->length = pa_e_data->length; + krb5_free_data(context, pa_e_data); + pa_e_data = NULL; + if (use_saved_retval != 0) + retval = saved_retval; + } + if (pa_ok) return 0; /* pa system was not found, but principal doesn't require preauth */ if (!pa_found && - !isflagset(client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) && - !isflagset(client->attributes, KRB5_KDB_REQUIRES_HW_AUTH)) + !isflagset(client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) && + !isflagset(client->attributes, KRB5_KDB_REQUIRES_HW_AUTH)) return 0; if (!pa_found) { - char *emsg = krb5_get_error_message(context, retval); + emsg = krb5_get_error_message(context, retval); krb5_klog_syslog (LOG_INFO, "no valid preauth type found: %s", emsg); krb5_free_error_message(context, emsg); } -/* The following switch statement allows us - * to return some preauth system errors back to the client. - */ - switch(retval) { - case KRB5KRB_AP_ERR_BAD_INTEGRITY: + /* The following switch statement allows us + * to return some preauth system errors back to the client. + */ + switch(retval) { + case KRB5KRB_AP_ERR_BAD_INTEGRITY: case KRB5KRB_AP_ERR_SKEW: + case KRB5KDC_ERR_ETYPE_NOSUPP: + /* rfc 4556 */ + case KRB5KDC_ERR_CLIENT_NOT_TRUSTED: + case KRB5KDC_ERR_INVALID_SIG: + case KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED: + case KRB5KDC_ERR_CANT_VERIFY_CERTIFICATE: + case KRB5KDC_ERR_INVALID_CERTIFICATE: + case KRB5KDC_ERR_REVOKED_CERTIFICATE: + case KRB5KDC_ERR_REVOCATION_STATUS_UNKNOWN: + case KRB5KDC_ERR_CLIENT_NAME_MISMATCH: + case KRB5KDC_ERR_INCONSISTENT_KEY_PURPOSE: + case KRB5KDC_ERR_DIGEST_IN_CERT_NOT_ACCEPTED: + case KRB5KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED: + case KRB5KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED: + case KRB5KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED: + /* earlier drafts of what became rfc 4556 */ + case KRB5KDC_ERR_CERTIFICATE_MISMATCH: + case KRB5KDC_ERR_KDC_NOT_TRUSTED: + case KRB5KDC_ERR_REVOCATION_STATUS_UNAVAILABLE: + /* This value is shared with KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED. */ + /* case KRB5KDC_ERR_KEY_TOO_WEAK: */ return retval; default: return KRB5KDC_ERR_PREAUTH_FAILED; @@ -418,9 +1049,10 @@ check_padata (krb5_context context, krb5 * structures which should be returned by the KDC to the client */ krb5_error_code -return_padata(krb5_context context, krb5_db_entry *client, +return_padata(krb5_context context, krb5_db_entry *client, krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, - krb5_key_data *client_key, krb5_keyblock *encrypting_key) + krb5_key_data *client_key, krb5_keyblock *encrypting_key, + void **padata_context) { krb5_error_code retval; krb5_pa_data ** padata; @@ -428,7 +1060,15 @@ return_padata(krb5_context context, krb5 krb5_pa_data ** send_pa; krb5_pa_data * pa = 0; krb5_preauth_systems * ap; + int * pa_order; + int * pa_type; int size = 0; + void ** pa_context; + krb5_boolean key_modified; + krb5_keyblock original_key; + if ((!*padata_context)&& (make_padata_context(context, padata_context) != 0)) { + return KRB5KRB_ERR_GENERIC; + } for (ap = preauth_systems; ap->type != -1; ap++) { if (ap->return_padata) @@ -437,13 +1077,42 @@ return_padata(krb5_context context, krb5 if ((send_pa_list = malloc((size+1) * sizeof(krb5_pa_data *))) == NULL) return ENOMEM; + if ((pa_order = malloc((size+1) * sizeof(int))) == NULL) { + free(send_pa_list); + return ENOMEM; + } + sort_pa_order(context, request, pa_order); + + retval = krb5_copy_keyblock_contents(context, encrypting_key, + &original_key); + if (retval) { + free(send_pa_list); + free(pa_order); + return retval; + } + key_modified = FALSE; send_pa = send_pa_list; *send_pa = 0; - - for (ap = preauth_systems; ap->type != -1; ap++) { + + for (pa_type = pa_order; *pa_type != -1; pa_type++) { + ap = &preauth_systems[*pa_type]; + if (!key_modified) + if (original_key.enctype != encrypting_key->enctype) + key_modified = TRUE; + if (!key_modified) + if (original_key.length != encrypting_key->length) + key_modified = TRUE; + if (!key_modified) + if (memcmp(original_key.contents, encrypting_key->contents, + original_key.length) != 0) + key_modified = TRUE; + if (key_modified && (ap->flags & PA_REPLACES_KEY)) + continue; if (ap->return_padata == 0) continue; + if (find_pa_context(ap, *padata_context, &pa_context)) + continue; pa = 0; if (request->padata) { for (padata = request->padata; *padata; padata++) { @@ -453,9 +1122,12 @@ return_padata(krb5_context context, krb5 } } } - if ((retval = ap->return_padata(context, pa, client, request, reply, - client_key, encrypting_key, send_pa))) + if ((retval = ap->return_padata(context, pa, client, req_pkt, request, reply, + client_key, encrypting_key, send_pa, + get_entry_data, ap->plugin_context, + pa_context))) { goto cleanup; + } if (*send_pa) send_pa++; @@ -470,6 +1142,8 @@ return_padata(krb5_context context, krb5 } cleanup: + krb5_free_keyblock_contents(context, &original_key); + free(pa_order); if (send_pa_list) krb5_free_pa_data(context, send_pa_list); return (retval); @@ -508,8 +1182,13 @@ request_contains_enctype (krb5_context c static krb5_error_code verify_enc_timestamp(krb5_context context, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_enc_tkt_part *enc_tkt_reply, - krb5_pa_data *pa) + krb5_pa_data *pa, + preauth_get_entry_data_proc ets_get_entry_data, + void *pa_system_context, + void **pa_request_context, + krb5_data **e_data) { krb5_pa_enc_ts * pa_enc = 0; krb5_error_code retval; @@ -749,6 +1428,8 @@ cleanup: static krb5_error_code get_etype_info(krb5_context context, krb5_kdc_req *request, krb5_db_entry *client, krb5_db_entry *server, + preauth_get_entry_data_proc etype_get_entry_data, + void *pa_system_context, krb5_pa_data *pa_data) { int i; @@ -764,6 +1445,8 @@ get_etype_info(krb5_context context, krb static krb5_error_code get_etype_info2(krb5_context context, krb5_kdc_req *request, krb5_db_entry *client, krb5_db_entry *server, + preauth_get_entry_data_proc etype_get_entry_data, + void *pa_system_context, krb5_pa_data *pa_data) { return etype_info_helper( context, request, client, server, pa_data, 1); @@ -849,10 +1532,14 @@ etype_info_as_rep_helper(krb5_context co static krb5_error_code return_etype_info2(krb5_context context, krb5_pa_data * padata, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, krb5_keyblock *encrypting_key, - krb5_pa_data **send_pa) + krb5_pa_data **send_pa, + preauth_get_entry_data_proc etype_get_entry_data, + void *pa_system_context, + void **pa_request_context) { return etype_info_as_rep_helper(context, padata, client, request, reply, client_key, encrypting_key, send_pa, 1); @@ -862,10 +1549,14 @@ return_etype_info2(krb5_context context, static krb5_error_code return_etype_info(krb5_context context, krb5_pa_data * padata, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, krb5_keyblock *encrypting_key, - krb5_pa_data **send_pa) + krb5_pa_data **send_pa, + preauth_get_entry_data_proc etypeget_entry_data, + void *pa_system_context, + void **pa_request_context) { return etype_info_as_rep_helper(context, padata, client, request, reply, client_key, encrypting_key, send_pa, 0); @@ -873,9 +1564,12 @@ return_etype_info(krb5_context context, static krb5_error_code return_pw_salt(krb5_context context, krb5_pa_data *in_padata, - krb5_db_entry *client, krb5_kdc_req *request, + krb5_db_entry *client, krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, - krb5_keyblock *encrypting_key, krb5_pa_data **send_pa) + krb5_keyblock *encrypting_key, krb5_pa_data **send_pa, + preauth_get_entry_data_proc etype_get_entry_data, + void *pa_system_context, + void **pa_request_context) { krb5_error_code retval; krb5_pa_data * padata; @@ -960,9 +1654,12 @@ cleanup: static krb5_error_code return_sam_data(krb5_context context, krb5_pa_data *in_padata, - krb5_db_entry *client, krb5_kdc_req *request, + krb5_db_entry *client, krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, krb5_key_data *client_key, - krb5_keyblock *encrypting_key, krb5_pa_data **send_pa) + krb5_keyblock *encrypting_key, krb5_pa_data **send_pa, + preauth_get_entry_data_proc sam_get_entry_data, + void *pa_system_context, + void **pa_request_context) { krb5_error_code retval; krb5_data scratch; @@ -1101,7 +1798,8 @@ static struct { static krb5_error_code get_sam_edata(krb5_context context, krb5_kdc_req *request, krb5_db_entry *client, krb5_db_entry *server, - krb5_pa_data *pa_data) + preauth_get_entry_data_proc sam_get_entry_data, + void *pa_system_context, krb5_pa_data *pa_data) { krb5_error_code retval; krb5_sam_challenge sc; @@ -1472,8 +2170,13 @@ cleanup: static krb5_error_code verify_sam_response(krb5_context context, krb5_db_entry *client, + krb5_data *req_pkt, krb5_kdc_req *request, krb5_enc_tkt_part *enc_tkt_reply, - krb5_pa_data *pa) + krb5_pa_data *pa, + preauth_get_entry_data_proc sam_get_entry_data, + void *pa_system_context, + void **pa_request_context, + krb5_data **e_data) { krb5_error_code retval; krb5_data scratch; --- krb5/src/kdc/main.c +++ krb5/src/kdc/main.c @@ -382,10 +382,13 @@ setup_signal_handlers(void) (void) sigaction(SIGTERM, &s_action, (struct sigaction *) NULL); s_action.sa_handler = request_hup; (void) sigaction(SIGHUP, &s_action, (struct sigaction *) NULL); + s_action.sa_handler = SIG_IGN; + (void) sigaction(SIGPIPE, &s_action, (struct sigaction *) NULL); #else /* POSIX_SIGNALS */ signal(SIGINT, request_exit); signal(SIGTERM, request_exit); signal(SIGHUP, request_hup); + signal(SIGPIPE, SIG_IGN); #endif /* POSIX_SIGNALS */ return; @@ -711,6 +714,8 @@ int main(int argc, char **argv) setup_signal_handlers(); + load_preauth_plugins(kcontext); + retval = setup_sam(); if (retval) { com_err(argv[0], retval, "while initializing SAM"); @@ -738,6 +743,7 @@ int main(int argc, char **argv) errout++; } krb5_klog_syslog(LOG_INFO, "shutting down"); + unload_preauth_plugins(kcontext); krb5_klog_close(kdc_context); finish_realms(argv[0]); if (kdc_realmlist) --- krb5/src/kdc/kdc_util.h +++ krb5/src/kdc/kdc_util.h @@ -107,7 +107,7 @@ void rep_etypes2str(char *s, size_t len, krb5_kdc_rep *rep); /* do_as_req.c */ -krb5_error_code process_as_req (krb5_kdc_req *, +krb5_error_code process_as_req (krb5_kdc_req *, krb5_data *, const krb5_fulladdr *, krb5_data ** ); @@ -146,15 +146,23 @@ void get_preauth_hint_list (krb5_kdc_req krb5_db_entry *client, krb5_db_entry *server, krb5_data *e_data); +krb5_error_code load_preauth_plugins(krb5_context context); +krb5_error_code unload_preauth_plugins(krb5_context context); + krb5_error_code check_padata - (krb5_context context, krb5_db_entry *client, - krb5_kdc_req *request, krb5_enc_tkt_part *enc_tkt_reply); + (krb5_context context, krb5_db_entry *client, krb5_data *req_pkt, + krb5_kdc_req *request, krb5_enc_tkt_part *enc_tkt_reply, + void **padata_context, krb5_data *e_data); krb5_error_code return_padata (krb5_context context, krb5_db_entry *client, - krb5_kdc_req *request, krb5_kdc_rep *reply, - krb5_key_data *client_key, krb5_keyblock *encrypting_key); + krb5_data *req_pkt, krb5_kdc_req *request, krb5_kdc_rep *reply, + krb5_key_data *client_key, krb5_keyblock *encrypting_key, + void **padata_context); +krb5_error_code free_padata_context + (krb5_context context, void **padata_context); + /* replay.c */ krb5_boolean kdc_check_lookaside (krb5_data *, krb5_data **); void kdc_insert_lookaside (krb5_data *, krb5_data *); @@ -191,4 +199,8 @@ void enable_v4_crossrealm(char *); ((X) == ADDRTYPE_INET ? AF_INET : -1) #endif +/* RFC 4120: KRB5KDC_ERR_KEY_TOO_WEAK + * RFC 4556: KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED */ +#define KRB5KDC_ERR_KEY_TOO_WEAK KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED + #endif /* __KRB5_KDC_UTIL__ */ --- krb5/src/lib/krb5/os/init_os_ctx.c +++ krb5/src/lib/krb5/os/init_os_ctx.c @@ -391,6 +391,8 @@ krb5_os_init_context(krb5_context ctx, k ctx->vtbl = 0; PLUGIN_DIR_INIT(&ctx->libkrb5_plugins); + PLUGIN_DIR_INIT(&ctx->preauth_plugins); + ctx->preauth_context = NULL; retval = os_init_paths(ctx, kdc); /* @@ -492,6 +494,11 @@ krb5_os_free_context(krb5_context ctx) ctx->profile = 0; } + if (ctx->preauth_context) { + krb5_free_preauth_context(ctx); + ctx->preauth_context = NULL; + } + krb5int_close_plugin_dirs (&ctx->preauth_plugins); krb5int_close_plugin_dirs (&ctx->libkrb5_plugins); #ifdef _WIN32 --- krb5/src/lib/krb5/krb/init_ctx.c +++ krb5/src/lib/krb5/krb/init_ctx.c @@ -97,7 +97,7 @@ krb5_init_secure_context(krb5_context *c return init_common (context, TRUE, FALSE); } -krb5_error_code KRB5_CALLCONV +krb5_error_code krb5int_init_context_kdc(krb5_context *context) { return init_common (context, FALSE, TRUE); @@ -272,6 +272,8 @@ krb5_free_context(krb5_context ctx) ctx->ser_ctx = 0; } + krb5_clear_error_message(ctx); + ctx->magic = 0; free(ctx); } @@ -534,6 +536,9 @@ krb5_copy_context(krb5_context ctx, krb5 nctx->prompt_types = NULL; nctx->os_context->default_ccname = NULL; + memset(&nctx->preauth_plugins, 0, sizeof(nctx->preauth_plugins)); + nctx->preauth_context = NULL; + memset(&nctx->libkrb5_plugins, 0, sizeof(nctx->libkrb5_plugins)); nctx->vtbl = NULL; nctx->locate_fptrs = NULL; --- krb5/src/lib/krb5/krb/preauth2.c 2005-01-17 12:32:26.000000000 -0500 +++ krb5/src/lib/krb5/krb/preauth2.c @@ -30,6 +30,18 @@ */ #include "k5-int.h" +#include "osconf.h" +#include <krb5/preauth_plugin.h> + +#if !defined(_WIN32) +#include <unistd.h> +#endif + +#if TARGET_OS_MAC +static const char *objdirs[] = { KRB5_PLUGIN_BUNDLE_DIR, LIBDIR "/krb5/plugins/preauth", NULL }; /* should be a list */ +#else +static const char *objdirs[] = { LIBDIR "/krb5/plugins/preauth", NULL }; +#endif typedef krb5_error_code (*pa_function)(krb5_context, krb5_kdc_req *request, @@ -49,8 +61,458 @@ typedef struct _pa_types_t { int flags; } pa_types_t; -#define PA_REAL 0x0001 -#define PA_INFO 0x0002 +/* Create the per-krb5_context context. This means loading the modules + * if we haven't done that yet (applications which never obtain initial + * credentials should never hit this routine), breaking up the module's + * list of support pa_types so that we can iterate over the modules more + * easily, and copying over the relevant parts of the module's table. */ +void KRB5_CALLCONV +krb5_init_preauth_context(krb5_context kcontext) +{ + int n_modules, n_tables, i, j, k; + void **tables; + struct krb5plugin_preauth_client_ftable_v0 *table; + krb5_preauth_context *context = NULL; + void *plugin_context; + krb5_preauthtype pa_type; + void **rcpp; + + /* Only do this once for each krb5_context */ + if (kcontext->preauth_context != NULL) + return; + + /* load the plugins for the current context */ + if (PLUGIN_DIR_OPEN(&kcontext->preauth_plugins) == 0) { + if (krb5int_open_plugin_dirs(objdirs, NULL, + &kcontext->preauth_plugins, + &kcontext->err) != 0) { + return; + } + } + + /* pull out the module function tables for all of the modules */ + tables = NULL; + if (krb5int_get_plugin_dir_data(&kcontext->preauth_plugins, + "preauthentication_client_0_backport_1_6", + &tables, + &kcontext->err) != 0) { + return; + } + if (tables == NULL) { + return; + } + + /* count how many modules we ended up loading, and how many preauth + * types we may claim to support as a result */ + n_modules = 0; + for (n_tables = 0; + (tables != NULL) && (tables[n_tables] != NULL); + n_tables++) { + table = tables[n_tables]; + if ((table->pa_type_list != NULL) && (table->process != NULL)) { + for (j = 0; table->pa_type_list[j] > 0; j++) { + n_modules++; + } + } + } + + /* allocate the space we need */ + context = malloc(sizeof(*context)); + if (context == NULL) { + krb5int_free_plugin_dir_data(tables); + return; + } + context->modules = malloc(sizeof(context->modules[0]) * n_modules); + if (context->modules == NULL) { + krb5int_free_plugin_dir_data(tables); + free(context); + return; + } + memset(context->modules, 0, sizeof(context->modules[0]) * n_modules); + context->n_modules = n_modules; + + /* fill in the structure */ + k = 0; + for (i = 0; i < n_tables; i++) { + table = tables[i]; + if ((table->pa_type_list != NULL) && (table->process != NULL)) { + plugin_context = NULL; + if ((table->init != NULL) && + ((*table->init)(kcontext, &plugin_context) != 0)) { +#ifdef DEBUG + fprintf (stderr, "init err, skipping module \"%s\"\n", + table->name); +#endif + continue; + } + + rcpp = NULL; + for (j = 0; table->pa_type_list[j] > 0; j++) { + pa_type = table->pa_type_list[j]; + context->modules[k].pa_type = pa_type; + context->modules[k].enctypes = table->enctype_list; + context->modules[k].plugin_context = plugin_context; + /* Only call client_fini once per plugin */ + if (j == 0) + context->modules[k].client_fini = table->fini; + else + context->modules[k].client_fini = NULL; + context->modules[k].ftable = table; + context->modules[k].name = table->name; + context->modules[k].flags = (*table->flags)(kcontext, pa_type); + context->modules[k].use_count = 0; + context->modules[k].client_process = table->process; + context->modules[k].client_tryagain = table->tryagain; + context->modules[k].request_context = NULL; + /* + * Only call request_init and request_fini once per plugin. + * Only the first module within each plugin will ever + * have request_context filled in. Every module within + * the plugin will have its request_context_pp pointing + * to that entry's request_context. That way all the + * modules within the plugin share the same request_context + */ + if (j == 0) { + context->modules[k].client_req_init = table->request_init; + context->modules[k].client_req_fini = table->request_fini; + rcpp = &context->modules[k].request_context; + } else { + context->modules[k].client_req_init = NULL; + context->modules[k].client_req_fini = NULL; + } + context->modules[k].request_context_pp = rcpp; +#ifdef DEBUG + fprintf (stderr, "init module \"%s\", pa_type %d, flag %d\n", + context->modules[k].name, + context->modules[k].pa_type, + context->modules[k].flags); +#endif + k++; + } + } + } + krb5int_free_plugin_dir_data(tables); + + /* return the result */ + kcontext->preauth_context = context; +} + +/* Zero the use counts for the modules herein. Usually used before we + * start processing any data from the server, at which point every module + * will again be able to take a crack at whatever the server sent. */ +void KRB5_CALLCONV +krb5_clear_preauth_context_use_counts(krb5_context context) +{ + int i; + if (context->preauth_context != NULL) { + for (i = 0; i < context->preauth_context->n_modules; i++) { + context->preauth_context->modules[i].use_count = 0; + } + } +} + +/* Free the per-krb5_context preauth_context. This means clearing any + * plugin-specific context which may have been created, and then + * freeing the context itself. */ +void KRB5_CALLCONV +krb5_free_preauth_context(krb5_context context) +{ + int i; + void *pctx; + if (context->preauth_context != NULL) { + for (i = 0; i < context->preauth_context->n_modules; i++) { + pctx = context->preauth_context->modules[i].plugin_context; + if (context->preauth_context->modules[i].client_fini != NULL) { + (*context->preauth_context->modules[i].client_fini)(context, pctx); + } + memset(&context->preauth_context->modules[i], 0, + sizeof(context->preauth_context->modules[i])); + } + if (context->preauth_context->modules != NULL) { + free(context->preauth_context->modules); + context->preauth_context->modules = NULL; + } + free(context->preauth_context); + context->preauth_context = NULL; + } +} + +/* Initialize the per-AS-REQ context. This means calling the client_req_init + * function to give the plugin a chance to allocate a per-request context. */ +void KRB5_CALLCONV +krb5_preauth_request_context_init(krb5_context context) +{ + int i; + void *rctx, *pctx; + + /* Limit this to only one attempt per context? */ + if (context->preauth_context == NULL) + krb5_init_preauth_context(context); + if (context->preauth_context != NULL) { + for (i = 0; i < context->preauth_context->n_modules; i++) { + pctx = context->preauth_context->modules[i].plugin_context; + if (context->preauth_context->modules[i].client_req_init != NULL) { + rctx = context->preauth_context->modules[i].request_context_pp; + (*context->preauth_context->modules[i].client_req_init) (context, pctx, rctx); + } + } + } +} + +/* Free the per-AS-REQ context. This means clearing any request-specific + * context which the plugin may have created. */ +void KRB5_CALLCONV +krb5_preauth_request_context_fini(krb5_context context) +{ + int i; + void *rctx, *pctx; + if (context->preauth_context != NULL) { + for (i = 0; i < context->preauth_context->n_modules; i++) { + pctx = context->preauth_context->modules[i].plugin_context; + rctx = context->preauth_context->modules[i].request_context; + if (rctx != NULL) { + if (context->preauth_context->modules[i].client_req_fini != NULL) { + (*context->preauth_context->modules[i].client_req_fini)(context, pctx, rctx); + } + context->preauth_context->modules[i].request_context = NULL; + } + } + } +} + +/* Add the named encryption type to the existing list of ktypes. */ +static void +grow_ktypes(krb5_enctype **out_ktypes, int *out_nktypes, krb5_enctype ktype) +{ + int i; + krb5_enctype *ktypes; + for (i = 0; i < *out_nktypes; i++) { + if ((*out_ktypes)[i] == ktype) + return; + } + ktypes = malloc((*out_nktypes + 2) * sizeof(ktype)); + if (ktypes) { + for (i = 0; i < *out_nktypes; i++) + ktypes[i] = (*out_ktypes)[i]; + ktypes[i++] = ktype; + ktypes[i] = 0; + free(*out_ktypes); + *out_ktypes = ktypes; + *out_nktypes = i; + } +} + +/* Add the given pa_data item to the list of items. Factored out here to make + * reading the do_preauth logic easier to read. */ +static int +grow_pa_list(krb5_pa_data ***out_pa_list, int *out_pa_list_size, + krb5_pa_data *addition) +{ + krb5_pa_data **pa_list; + int i; + + if (out_pa_list == NULL) { + return EINVAL; + } + + if (*out_pa_list == NULL) { + /* Allocate room for one entry and a NULL terminator. */ + pa_list = malloc(2 * sizeof(krb5_pa_data *)); + if (pa_list == NULL) + return ENOMEM; + pa_list[0] = addition; + pa_list[1] = NULL; + *out_pa_list = pa_list; + *out_pa_list_size = 1; + } else { + /* Allocate room for one more entry and a NULL terminator. */ + pa_list = malloc((*out_pa_list_size + 2) * sizeof(krb5_pa_data *)); + if (pa_list == NULL) + return ENOMEM; + for (i = 0; i < *out_pa_list_size; i++) + pa_list[i] = (*out_pa_list)[i]; + pa_list[i++] = addition; + pa_list[i++] = NULL; + free(*out_pa_list); + *out_pa_list = pa_list; + *out_pa_list_size = i; + } + return 0; +} + +/* + * Retrieve a specific piece of information required by the plugin and + * return it in a new krb5_data item. There are separate request_types + * to obtain the data and free it. + * + * This may require massaging data into a contrived format, but it will + * hopefully keep us from having to reveal library-internal functions + * or data to the plugin modules. + */ + +static krb5_error_code +client_data_proc(krb5_context kcontext, + krb5_preauth_client_rock *rock, + krb5_int32 request_type, + krb5_data **retdata) +{ + krb5_data *ret; + char *data; + + if (rock->magic != CLIENT_ROCK_MAGIC) + return EINVAL; + if (retdata == NULL) + return EINVAL; + + switch (request_type) { + case krb5plugin_preauth_client_get_etype: + { + krb5_enctype *eptr; + if (rock->as_reply == NULL) + return ENOENT; + ret = malloc(sizeof(krb5_data)); + if (ret == NULL) + return ENOMEM; + data = malloc(sizeof(krb5_enctype)); + if (data == NULL) { + free(ret); + return ENOMEM; + } + ret->data = data; + ret->length = sizeof(krb5_enctype); + eptr = (krb5_enctype *)data; + *eptr = rock->as_reply->enc_part.enctype; + *retdata = ret; + return 0; + } + break; + case krb5plugin_preauth_client_free_etype: + ret = *retdata; + if (ret == NULL) + return 0; + if (ret->data) + free(ret->data); + free(ret); + return 0; + break; + default: + return EINVAL; + } +} + +/* Tweak the request body, for now adding any enctypes which the module claims + * to add support for to the list, but in the future perhaps doing more + * involved things. */ +void KRB5_CALLCONV +krb5_preauth_prepare_request(krb5_context kcontext, + krb5_get_init_creds_opt *options, + krb5_kdc_req *request) +{ + int i, j; + + if (kcontext->preauth_context == NULL) { + return; + } + /* Add the module-specific enctype list to the request, but only if + * it's something we can safely modify. */ + if (!(options && (options->flags & KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST))) { + for (i = 0; i < kcontext->preauth_context->n_modules; i++) { + if (kcontext->preauth_context->modules[i].enctypes == NULL) + continue; + for (j = 0; kcontext->preauth_context->modules[i].enctypes[j] != 0; j++) { + grow_ktypes(&request->ktype, &request->nktypes, + kcontext->preauth_context->modules[i].enctypes[j]); + } + } + } +} + +/* Find the first module which provides for the named preauth type which also + * hasn't had a chance to run yet (INFO modules don't count, because as a rule + * they don't generate preauth data), and run it. */ +static krb5_error_code +krb5_run_preauth_plugins(krb5_context kcontext, + int module_required_flags, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data *in_padata, + krb5_prompter_fct prompter, + void *prompter_data, + preauth_get_as_key_proc gak_fct, + krb5_data *salt, + krb5_data *s2kparams, + void *gak_data, + krb5_preauth_client_rock *get_data_rock, + krb5_keyblock *as_key, + krb5_pa_data ***out_pa_list, + int *out_pa_list_size, + int *module_ret, + int *module_flags) +{ + int i; + krb5_pa_data *out_pa_data; + krb5_error_code ret; + struct _krb5_preauth_context_module *module; + + if (kcontext->preauth_context == NULL) { + return ENOENT; + } + /* iterate over all loaded modules */ + for (i = 0; i < kcontext->preauth_context->n_modules; i++) { + module = &kcontext->preauth_context->modules[i]; + /* skip over those which don't match the preauth type */ + if (module->pa_type != in_padata->pa_type) + continue; + /* skip over those which don't match the flags (INFO vs REAL, mainly) */ + if ((module->flags & module_required_flags) == 0) + continue; + /* if it's a REAL module, try to call it only once per library call */ + if (module_required_flags & PA_REAL) { + if (module->use_count > 0) { +#ifdef DEBUG + fprintf(stderr, "skipping already-used module \"%s\"(%d)\n", + module->name, module->pa_type); +#endif + continue; + } + module->use_count++; + } + /* run the module's callback function */ + out_pa_data = NULL; +#ifdef DEBUG + fprintf(stderr, "using module \"%s\" (%d), flags = %d\n", + module->name, module->pa_type, module->flags); +#endif + ret = module->client_process(kcontext, + module->plugin_context, + *module->request_context_pp, + client_data_proc, + get_data_rock, + request, + encoded_request_body, + encoded_previous_request, + in_padata, + prompter, prompter_data, + gak_fct, gak_data, salt, s2kparams, + as_key, + &out_pa_data); + /* Make note of the module's flags and status. */ + *module_flags = module->flags; + *module_ret = ret; + /* Save the new preauth data item. */ + if (out_pa_data != NULL) { + ret = grow_pa_list(out_pa_list, out_pa_list_size, out_pa_data); + if (ret != 0) + return ret; + } + break; + } + if (i >= kcontext->preauth_context->n_modules) { + return ENOENT; + } + return 0; +} static krb5_error_code pa_salt(krb5_context context, @@ -101,8 +563,8 @@ krb5_error_code pa_enc_timestamp(krb5_co #ifdef DEBUG fprintf (stderr, "%s:%d: salt len=%d", __FILE__, __LINE__, salt->length); - if (salt->length > 0) - fprintf (stderr, " '%*s'", salt->length, salt->data); + if ((int) salt->length > 0) + fprintf (stderr, " '%.*s'", salt->length, salt->data); fprintf (stderr, "; *etype=%d request->ktype[0]=%d\n", *etype, request->ktype[0]); #endif @@ -819,15 +1281,88 @@ static const pa_types_t pa_types[] = { }, }; -krb5_error_code +/* + * If one of the modules can adjust its AS_REQ data using the contents of the + * err_reply, return 0. If it's the sort of correction which requires that we + * ask the user another question, we let the calling application deal with it. + */ +krb5_error_code KRB5_CALLCONV +krb5_do_preauth_tryagain(krb5_context kcontext, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data **padata, + krb5_pa_data ***return_padata, + krb5_error *err_reply, + krb5_data *salt, krb5_data *s2kparams, + krb5_enctype *etype, + krb5_keyblock *as_key, + krb5_prompter_fct prompter, void *prompter_data, + krb5_gic_get_as_key_fct gak_fct, void *gak_data, + krb5_preauth_client_rock *get_data_rock) +{ + krb5_error_code ret; + krb5_pa_data *out_padata; + krb5_preauth_context *context; + struct _krb5_preauth_context_module *module; + int i, j; + int out_pa_list_size = 0; + + ret = KRB5KRB_ERR_GENERIC; + if (kcontext->preauth_context == NULL) { + return KRB5KRB_ERR_GENERIC; + } + context = kcontext->preauth_context; + if (context == NULL) { + return KRB5KRB_ERR_GENERIC; + } + + for (i = 0; padata[i] != NULL && padata[i]->pa_type != 0; i++) { + out_padata = NULL; + for (j = 0; j < context->n_modules; j++) { + module = &context->modules[j]; + if (module->pa_type != padata[i]->pa_type) { + continue; + } + if (module->client_tryagain == NULL) { + continue; + } + if ((*module->client_tryagain)(kcontext, + module->plugin_context, + *module->request_context_pp, + client_data_proc, + get_data_rock, + request, + encoded_request_body, + encoded_previous_request, + padata[i], + err_reply, + prompter, prompter_data, + gak_fct, gak_data, salt, s2kparams, + as_key, + &out_padata) == 0) { + if (out_padata != NULL) { + grow_pa_list(return_padata, &out_pa_list_size, out_padata); + return 0; + } + } + } + } + return ret; +} + +krb5_error_code KRB5_CALLCONV krb5_do_preauth(krb5_context context, krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, krb5_pa_data **in_padata, krb5_pa_data ***out_padata, krb5_data *salt, krb5_data *s2kparams, krb5_enctype *etype, krb5_keyblock *as_key, krb5_prompter_fct prompter, void *prompter_data, - krb5_gic_get_as_key_fct gak_fct, void *gak_data) + krb5_gic_get_as_key_fct gak_fct, void *gak_data, + krb5_preauth_client_rock *get_data_rock) { int h, i, j, out_pa_list_size; int seen_etype_info2 = 0; @@ -844,9 +1379,9 @@ krb5_do_preauth(krb5_context context, } #ifdef DEBUG - fprintf (stderr, "salt len=%d", salt->length); - if (salt->length > 0) - fprintf (stderr, " '%*s'", salt->length, salt->data); + fprintf (stderr, "salt len=%d", (int) salt->length); + if ((int) salt->length > 0) + fprintf (stderr, " '%.*s'", salt->length, salt->data); fprintf (stderr, "; preauth data types:"); for (i = 0; in_padata[i]; i++) { fprintf (stderr, " %d", in_padata[i]->pa_type); @@ -953,7 +1488,7 @@ krb5_do_preauth(krb5_context context, fprintf (stderr, "etype info %d: etype %d salt len=%d", j, e->etype, e->length); if (e->length > 0 && e->length != KRB5_ETYPE_NO_SALT) - fprintf (stderr, " '%*s'", e->length, e->salt); + fprintf (stderr, " '%.*s'", e->length, e->salt); fprintf (stderr, "\n"); } #endif @@ -967,9 +1502,14 @@ krb5_do_preauth(krb5_context context, default: ; } - for (j=0; pa_types[j].type >= 0; j++) { + /* Try the internally-provided preauth type list. */ + if (!realdone) for (j=0; pa_types[j].type >= 0; j++) { if ((in_padata[i]->pa_type == pa_types[j].type) && (pa_types[j].flags & paorder[h])) { +#ifdef DEBUG + fprintf (stderr, "calling internal function for pa_type " + "%d, flag %d\n", pa_types[j].type, paorder[h]); +#endif out_pa = NULL; if ((ret = ((*pa_types[j].fct)(context, request, @@ -980,41 +1520,54 @@ krb5_do_preauth(krb5_context context, goto cleanup; } - if (out_pa) { - if (out_pa_list == NULL) { - if ((out_pa_list = - (krb5_pa_data **) - malloc(2*sizeof(krb5_pa_data *))) - == NULL) { - ret = ENOMEM; - goto cleanup; - } - } else { - if ((out_pa_list = - (krb5_pa_data **) - realloc(out_pa_list, - (out_pa_list_size+2)* - sizeof(krb5_pa_data *))) - == NULL) { - /* XXX this will leak the pointers which - have already been allocated. oh well. */ - ret = ENOMEM; - goto cleanup; - } - } - - out_pa_list[out_pa_list_size++] = out_pa; + ret = grow_pa_list(&out_pa_list, &out_pa_list_size, + out_pa); + if (ret != 0) { + goto cleanup; } if (paorder[h] == PA_REAL) realdone = 1; } } + + /* Try to use plugins now. */ + if (!realdone) { + krb5_init_preauth_context(context); + if (context->preauth_context != NULL) { + int module_ret, module_flags; +#ifdef DEBUG + fprintf (stderr, "trying modules for pa_type %d, flag %d\n", + in_padata[i]->pa_type, paorder[h]); +#endif + ret = krb5_run_preauth_plugins(context, + paorder[h], + request, + encoded_request_body, + encoded_previous_request, + in_padata[i], + prompter, + prompter_data, + gak_fct, + salt, s2kparams, + gak_data, + get_data_rock, + as_key, + &out_pa_list, + &out_pa_list_size, + &module_ret, + &module_flags); + if (ret == 0) { + if (module_ret == 0) { + if (paorder[h] == PA_REAL) { + realdone = 1; + } + } + } + } + } } } - if (out_pa_list) - out_pa_list[out_pa_list_size++] = NULL; - *out_padata = out_pa_list; if (etype_info) krb5_free_etype_info(context, etype_info); --- krb5/src/lib/krb5/krb/Makefile.in +++ krb5/src/lib/krb5/krb/Makefile.in @@ -6,7 +6,7 @@ RUN_SETUP = @KRB5_RUN_ENV@ PROG_LIBPATH=-L$(TOPLIBD) PROG_RPATH=$(KRB5_LIBDIR) LOCALINCLUDES = -I$(srcdir)/../os -I$(SRCTOP) -DEFS= +DEFS=-DLIBDIR=\"$(KRB5_LIBDIR)\" ##DOS##BUILDTOP = ..\..\.. ##DOS##PREFIXDIR=krb --- krb5/src/lib/krb5/krb/get_in_tkt.c 2005-08-15 20:38:17.000000000 -0400 +++ krb5/src/lib/krb5/krb/get_in_tkt.c @@ -78,6 +78,9 @@ typedef krb5_error_code (*git_decrypt_pr static krb5_error_code make_preauth_list (krb5_context, krb5_preauthtype *, int, krb5_pa_data ***); +static krb5_error_code sort_krb5_padata_sequence(krb5_context context, + krb5_data *realm, + krb5_pa_data **padata); /* * This function performs 32 bit bounded addition so we can generate @@ -105,7 +108,6 @@ static krb5_int32 krb5int_addint32 (krb5 static krb5_error_code send_as_request(krb5_context context, krb5_kdc_req *request, - krb5_timestamp *time_now, krb5_error ** ret_err_reply, krb5_kdc_rep ** ret_as_reply, int *use_master) @@ -116,17 +118,16 @@ send_as_request(krb5_context context, krb5_data reply; char k4_version; /* same type as *(krb5_data::data) */ int tcp_only = 0; + krb5_timestamp time_now; reply.data = 0; - - if ((retval = krb5_timeofday(context, time_now))) - goto cleanup; - /* - * XXX we know they are the same size... and we should do - * something better than just the current time - */ - request->nonce = (krb5_int32) *time_now; + /* set the nonce if the caller expects us to do it */ + if (request->nonce == 0) { + if ((retval = krb5_timeofday(context, &time_now))) + goto cleanup; + request->nonce = (krb5_int32) time_now; + } /* encode & send to KDC */ if ((retval = encode_krb5_as_req(request, &packet)) != 0) @@ -437,7 +438,6 @@ static const krb5_enctype get_in_tkt_enc 0 }; - krb5_error_code KRB5_CALLCONV krb5_get_in_tkt(krb5_context context, const krb5_flags options, @@ -486,6 +486,7 @@ krb5_get_in_tkt(krb5_context context, request.kdc_options = options; request.client = creds->client; request.server = creds->server; + request.nonce = 0; request.from = creds->times.starttime; request.till = creds->times.endtime; request.rtime = creds->times.renew_till; @@ -553,7 +554,17 @@ krb5_get_in_tkt(krb5_context context, err_reply = 0; as_reply = 0; - if ((retval = send_as_request(context, &request, &time_now, &err_reply, + + if ((retval = krb5_timeofday(context, &time_now))) + goto cleanup; + + /* + * XXX we know they are the same size... and we should do + * something better than just the current time + */ + request.nonce = (krb5_int32) time_now; + + if ((retval = send_as_request(context, &request, &err_reply, &as_reply, &use_master))) goto cleanup; @@ -565,6 +576,11 @@ krb5_get_in_tkt(krb5_context context, krb5_free_error(context, err_reply); if (retval) goto cleanup; + retval = sort_krb5_padata_sequence(context, + &request.server->realm, + padata); + if (retval) + goto cleanup; continue; } else { retval = (krb5_error_code) err_reply->error @@ -746,6 +762,79 @@ krb5_libdefault_boolean(krb5_context con return(0); } +/* Sort a pa_data sequence so that types named in the "preferred_preauth_types" + * libdefaults entry are listed before any others. */ +static krb5_error_code +sort_krb5_padata_sequence(krb5_context context, krb5_data *realm, + krb5_pa_data **padata) +{ + int i, j, base; + krb5_error_code ret; + const char *p; + long l; + char *q, *preauth_types = NULL; + krb5_pa_data *tmp; + int need_free_string = 1; + + if ((padata == NULL) || (padata[0] == NULL)) { + return 0; + } + + ret = krb5_libdefault_string(context, realm, "preferred_preauth_types", + &preauth_types); + if ((ret != 0) || (preauth_types == NULL)) { + /* Try to use PKINIT first. */ + preauth_types = "17, 16, 15, 14"; + need_free_string = 0; + } + +#ifdef DEBUG + fprintf (stderr, "preauth data types before sorting:"); + for (i = 0; padata[i]; i++) { + fprintf (stderr, " %d", padata[i]->pa_type); + } + fprintf (stderr, "\n"); +#endif + + base = 0; + for (p = preauth_types; *p != '\0';) { + /* skip whitespace to find an entry */ + p += strspn(p, ", "); + if (*p != '\0') { + /* see if we can extract a number */ + l = strtol(p, &q, 10); + if ((q != NULL) && (q > p)) { + /* got a valid number; search for a matchin entry */ + for (i = base; padata[i] != NULL; i++) { + /* bubble the matching entry to the front of the list */ + if (padata[i]->pa_type == l) { + tmp = padata[i]; + for (j = i; j > base; j--) + padata[j] = padata[j - 1]; + padata[base] = tmp; + base++; + break; + } + } + p = q; + } else { + break; + } + } + } + if (need_free_string) + free(preauth_types); + +#ifdef DEBUG + fprintf (stderr, "preauth data types after sorting:"); + for (i = 0; padata[i]; i++) + fprintf (stderr, " %d", padata[i]->pa_type); + fprintf (stderr, "\n"); +#endif + + return 0; +} + krb5_error_code KRB5_CALLCONV krb5_get_init_creds(krb5_context context, krb5_creds *creds, @@ -762,7 +851,8 @@ krb5_get_init_creds(krb5_context context { krb5_error_code ret; krb5_kdc_req request; - krb5_pa_data **padata; + krb5_data *encoded_request_body, *encoded_previous_request; + krb5_pa_data **preauth_to_use, **kdc_padata; int tempint; char *tempstr; krb5_deltat tkt_life; @@ -775,6 +865,7 @@ krb5_get_init_creds(krb5_context context krb5_kdc_rep *local_as_reply; krb5_timestamp time_now; krb5_enctype etype = 0; + krb5_preauth_client_rock get_data_rock; /* initialize everything which will be freed at cleanup */ @@ -784,19 +875,27 @@ krb5_get_init_creds(krb5_context context request.ktype = NULL; request.addresses = NULL; request.padata = NULL; - padata = NULL; + encoded_request_body = NULL; + encoded_previous_request = NULL; + preauth_to_use = NULL; + kdc_padata = NULL; as_key.length = 0; salt.length = 0; salt.data = NULL; local_as_reply = 0; + err_reply = NULL; + /* * Set up the basic request structure */ request.magic = KV5M_KDC_REQ; request.msg_type = KRB5_AS_REQ; + /* request.nonce is filled in when we send a request to the kdc */ + request.nonce = 0; + /* request.padata is filled in later */ request.kdc_options = context->kdc_default_options; @@ -921,7 +1020,9 @@ krb5_get_init_creds(krb5_context context goto cleanup; } - /* nonce is filled in by send_as_request */ + krb5_preauth_request_context_init(context); + + /* nonce is filled in by send_as_request if we don't take care of it */ if (options && (options->flags & KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST)) { request.ktype = options->etype_list; @@ -960,8 +1061,8 @@ krb5_get_init_creds(krb5_context context if (options && (options->flags & KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST)) { if ((ret = make_preauth_list(context, options->preauth_list, - options->preauth_list_length, - &padata))) + options->preauth_list_length, + &preauth_to_use))) goto cleanup; } @@ -975,44 +1076,118 @@ krb5_get_init_creds(krb5_context context salt.data = NULL; } - /* now, loop processing preauth data and talking to the kdc */ + /* set the request nonce */ + if ((ret = krb5_timeofday(context, &time_now))) + goto cleanup; + /* + * XXX we know they are the same size... and we should do + * something better than just the current time + */ + request.nonce = (krb5_int32) time_now; + + /* give the preauth plugins a chance to prep the request body */ + krb5_preauth_prepare_request(context, options, &request); + ret = encode_krb5_kdc_req_body(&request, &encoded_request_body); + if (ret) + goto cleanup; + + get_data_rock.magic = CLIENT_ROCK_MAGIC; + get_data_rock.as_reply = NULL; + + /* now, loop processing preauth data and talking to the kdc */ for (loopcount = 0; loopcount < MAX_IN_TKT_LOOPS; loopcount++) { if (request.padata) { krb5_free_pa_data(context, request.padata); request.padata = NULL; } + if (!err_reply) { + /* either our first attempt, or retrying after PREAUTH_NEEDED */ + if ((ret = krb5_do_preauth(context, + &request, + encoded_request_body, + encoded_previous_request, + preauth_to_use, &request.padata, + &salt, &s2kparams, &etype, &as_key, + prompter, prompter_data, + gak_fct, gak_data, + &get_data_rock))) + goto cleanup; + } else { + if (preauth_to_use != NULL) { + /* + * Retry after an error other than PREAUTH_NEEDED, + * using e-data to figure out what to change. + */ + ret = krb5_do_preauth_tryagain(context, + &request, + encoded_request_body, + encoded_previous_request, + preauth_to_use, &request.padata, + err_reply, + &salt, &s2kparams, &etype, + &as_key, + prompter, prompter_data, + gak_fct, gak_data, + &get_data_rock); + } else { + /* No preauth supplied, so can't query the plug-ins. */ + ret = KRB5KRB_ERR_GENERIC; + } + if (ret) { + /* couldn't come up with anything better */ + ret = err_reply->error + ERROR_TABLE_BASE_krb5; + } + krb5_free_error(context, err_reply); + err_reply = NULL; + if (ret) + goto cleanup; + } - if ((ret = krb5_do_preauth(context, &request, - padata, &request.padata, - &salt, &s2kparams, &etype, &as_key, prompter, - prompter_data, gak_fct, gak_data))) + if (encoded_previous_request != NULL) { + krb5_free_data(context, encoded_previous_request); + encoded_previous_request = NULL; + } + ret = encode_krb5_as_req(&request, &encoded_previous_request); + if (ret) goto cleanup; - if (padata) { - krb5_free_pa_data(context, padata); - padata = 0; - } - err_reply = 0; local_as_reply = 0; - if ((ret = send_as_request(context, &request, &time_now, &err_reply, + if ((ret = send_as_request(context, &request, &err_reply, &local_as_reply, use_master))) goto cleanup; if (err_reply) { if (err_reply->error == KDC_ERR_PREAUTH_REQUIRED && err_reply->e_data.length > 0) { + /* reset the list of preauth types to try */ + if (preauth_to_use) { + krb5_free_pa_data(context, preauth_to_use); + preauth_to_use = NULL; + } ret = decode_krb5_padata_sequence(&err_reply->e_data, - &padata); + &preauth_to_use); krb5_free_error(context, err_reply); + err_reply = NULL; + if (ret) + goto cleanup; + ret = sort_krb5_padata_sequence(context, + &request.server->realm, + preauth_to_use); if (ret) goto cleanup; + /* continue to next iteration */ } else { - ret = (krb5_error_code) err_reply->error - + ERROR_TABLE_BASE_krb5; - krb5_free_error(context, err_reply); - goto cleanup; + if (err_reply->e_data.length > 0) { + /* continue to next iteration */ + } else { + /* error + no hints = give up */ + ret = (krb5_error_code) err_reply->error + + ERROR_TABLE_BASE_krb5; + krb5_free_error(context, err_reply); + goto cleanup; + } } } else if (local_as_reply) { break; @@ -1028,16 +1203,20 @@ krb5_get_init_creds(krb5_context context } /* process any preauth data in the as_reply */ - - if ((ret = krb5_do_preauth(context, &request, - local_as_reply->padata, &padata, + krb5_clear_preauth_context_use_counts(context); + if ((ret = sort_krb5_padata_sequence(context, &request.server->realm, + local_as_reply->padata))) + goto cleanup; + get_data_rock.as_reply = local_as_reply; + if ((ret = krb5_do_preauth(context, + &request, + encoded_request_body, encoded_previous_request, + local_as_reply->padata, &kdc_padata, &salt, &s2kparams, &etype, &as_key, prompter, - prompter_data, gak_fct, gak_data))) + prompter_data, gak_fct, gak_data, + &get_data_rock))) goto cleanup; - /* XXX if there's padata on output, something is wrong, but it's - not obviously an error */ - /* XXX For 1.1.1 and prior KDC's, when SAM is used w/ USE_SAD_AS_KEY, the AS_REP comes back encrypted in the user's longterm key instead of in the SAD. If there was a SAM preauth, there @@ -1090,6 +1269,15 @@ krb5_get_init_creds(krb5_context context ret = 0; cleanup: + krb5_preauth_request_context_fini(context); + if (encoded_previous_request != NULL) { + krb5_free_data(context, encoded_previous_request); + encoded_previous_request = NULL; + } + if (encoded_request_body != NULL) { + krb5_free_data(context, encoded_request_body); + encoded_request_body = NULL; + } if (request.server) krb5_free_principal(context, request.server); if (request.ktype && @@ -1099,8 +1287,10 @@ cleanup: (!(options && (options->flags & KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST)))) krb5_free_addresses(context, request.addresses); - if (padata) - krb5_free_pa_data(context, padata); + if (preauth_to_use) + krb5_free_pa_data(context, preauth_to_use); + if (kdc_padata) + krb5_free_pa_data(context, kdc_padata); if (request.padata) krb5_free_pa_data(context, request.padata); if (as_key.length) --- krb5/src/lib/krb5/error_tables/krb5_err.et +++ krb5/src/lib/krb5/error_tables/krb5_err.et @@ -103,26 +103,26 @@ error_code KRB5PLACEHOLD_58, "KRB5 error error_code KRB5PLACEHOLD_59, "KRB5 error code 59" error_code KRB5KRB_ERR_GENERIC, "Generic error (see e-text)" error_code KRB5KRB_ERR_FIELD_TOOLONG, "Field is too long for this implementation" -error_code KRB5PLACEHOLD_62, "KRB5 error code 62" -error_code KRB5PLACEHOLD_63, "KRB5 error code 63" -error_code KRB5PLACEHOLD_64, "KRB5 error code 64" -error_code KRB5PLACEHOLD_65, "KRB5 error code 65" -error_code KRB5PLACEHOLD_66, "KRB5 error code 66" +error_code KRB5KDC_ERR_CLIENT_NOT_TRUSTED, "Client not trusted" +error_code KRB5KDC_ERR_KDC_NOT_TRUSTED, "KDC not trusted" +error_code KRB5KDC_ERR_INVALID_SIG, "Invalid signature" +error_code KRB5KDC_ERR_DH_KEY_PARAMETERS_NOT_ACCEPTED, "Key parameters not accepted" +error_code KRB5KDC_ERR_CERTIFICATE_MISMATCH, "Certificate mismatch" error_code KRB5PLACEHOLD_67, "KRB5 error code 67" error_code KRB5PLACEHOLD_68, "KRB5 error code 68" error_code KRB5PLACEHOLD_69, "KRB5 error code 69" -error_code KRB5PLACEHOLD_70, "KRB5 error code 70" -error_code KRB5PLACEHOLD_71, "KRB5 error code 71" -error_code KRB5PLACEHOLD_72, "KRB5 error code 72" -error_code KRB5PLACEHOLD_73, "KRB5 error code 73" -error_code KRB5PLACEHOLD_74, "KRB5 error code 74" -error_code KRB5PLACEHOLD_75, "KRB5 error code 75" -error_code KRB5PLACEHOLD_76, "KRB5 error code 76" -error_code KRB5PLACEHOLD_77, "KRB5 error code 77" -error_code KRB5PLACEHOLD_78, "KRB5 error code 78" -error_code KRB5PLACEHOLD_79, "KRB5 error code 79" -error_code KRB5PLACEHOLD_80, "KRB5 error code 80" -error_code KRB5PLACEHOLD_81, "KRB5 error code 81" +error_code KRB5KDC_ERR_CANT_VERIFY_CERTIFICATE, "Can't verify certificate" +error_code KRB5KDC_ERR_INVALID_CERTIFICATE, "Invalid certificate" +error_code KRB5KDC_ERR_REVOKED_CERTIFICATE, "Revoked certificate" +error_code KRB5KDC_ERR_REVOCATION_STATUS_UNKNOWN, "Revocation status unknown" +error_code KRB5KDC_ERR_REVOCATION_STATUS_UNAVAILABLE, "Revocation status unavailable" +error_code KRB5KDC_ERR_CLIENT_NAME_MISMATCH, "Client name mismatch" +error_code KRB5KDC_ERR_KDC_NAME_MISMATCH, "KDC name mismatch" +error_code KRB5KDC_ERR_INCONSISTENT_KEY_PURPOSE, "Inconsistent key purpose" +error_code KRB5KDC_ERR_DIGEST_IN_CERT_NOT_ACCEPTED, "Digest in certificate not accepted" +error_code KRB5KDC_ERR_PA_CHECKSUM_MUST_BE_INCLUDED, "Checksum must be included" +error_code KRB5KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED, "Digest in signed-data not accepted" +error_code KRB5KDC_ERR_PUBLIC_KEY_ENCRYPTION_NOT_SUPPORTED, "Public key encryption not supported" error_code KRB5PLACEHOLD_82, "KRB5 error code 82" error_code KRB5PLACEHOLD_83, "KRB5 error code 83" error_code KRB5PLACEHOLD_84, "KRB5 error code 84" --- krb5/src/include/k5-int.h +++ krb5/src/include/k5-int.h @@ -835,6 +835,90 @@ error(MIT_DES_KEYSIZE does not equal KRB #ifndef KRB5_PREAUTH__ #define KRB5_PREAUTH__ +#include <krb5/preauth_plugin.h> + +#define CLIENT_ROCK_MAGIC 0x4352434b +/* This structure is passed into the client preauth functions and passed + * back to the "get_data_proc" function so that it can locate the + * requested information. It is opaque to the plugin code and can be + * expanded in the future as new types of requests are defined which + * may require other things to be passed through. */ +typedef struct _krb5_preauth_client_rock { + krb5_magic magic; + krb5_kdc_rep *as_reply; +} krb5_preauth_client_rock; + +/* This structure lets us keep track of all of the modules which are loaded, + * turning the list of modules and their lists of implemented preauth types + * into a single list which we can walk easily. */ +typedef struct _krb5_preauth_context { + int n_modules; + struct _krb5_preauth_context_module { + /* Which of the possibly more than one preauth types which the + * module supports we're using at this point in the list. */ + krb5_preauthtype pa_type; + /* Encryption types which the client claims to support -- we + * copy them directly into the krb5_kdc_req structure during + * krb5_preauth_prepare_request(). */ + krb5_enctype *enctypes; + /* The plugin's per-plugin context and a function to clear it. */ + void *plugin_context; + void (*client_fini)(krb5_context context, void *plugin_context); + /* The module's table, and some of its members, copied here for + * convenience when we populated the list. */ + struct krb5plugin_preauth_client_ftable_v0 *ftable; + const char *name; + int flags, use_count; + krb5_error_code (*client_process)(krb5_context context, + void *plugin_context, + void *request_context, + preauth_get_client_data_proc get_data_proc, + krb5_preauth_client_rock *rock, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data *pa_data, + krb5_prompter_fct prompter, + void *prompter_data, + preauth_get_as_key_proc gak_fct, + void *gak_data, + krb5_data *salt, + krb5_data *s2kparams, + krb5_keyblock *as_key, + krb5_pa_data **out_pa_data); + krb5_error_code (*client_tryagain)(krb5_context context, + void *plugin_context, + void *request_context, + preauth_get_client_data_proc get_data_proc, + krb5_preauth_client_rock *rock, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data *old_pa_data, + krb5_error *err_reply, + krb5_prompter_fct prompter, + void *prompter_data, + preauth_get_as_key_proc gak_fct, + void *gak_data, + krb5_data *salt, + krb5_data *s2kparams, + krb5_keyblock *as_key, + krb5_pa_data **new_pa_data); + void (*client_req_init)(krb5_context context, void *plugin_context, + void **request_context); + void (*client_req_fini)(krb5_context context, void *plugin_context, + void *request_context); + /* The per-request context which the client_req_init() function + * might allocate, which we'll need to clean up later by + * calling the client_req_fini() function. */ + void *request_context; + /* A pointer to the request_context pointer. All modules within + * a plugin will point at the request_context of the first + * module within the plugin. */ + void **request_context_pp; + } *modules; +} krb5_preauth_context; + typedef struct _krb5_pa_enc_ts { krb5_timestamp patimestamp; krb5_int32 pausec; @@ -961,14 +1045,41 @@ void krb5int_populate_gic_opt ( krb5_preauthtype *pre_auth_types, krb5_creds *creds); -krb5_error_code krb5_do_preauth -(krb5_context, krb5_kdc_req *, - krb5_pa_data **, krb5_pa_data ***, - krb5_data *salt, krb5_data *s2kparams, - krb5_enctype *, - krb5_keyblock *, - krb5_prompter_fct, void *, - krb5_gic_get_as_key_fct, void *); +krb5_error_code KRB5_CALLCONV krb5_do_preauth + (krb5_context context, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data **in_padata, krb5_pa_data ***out_padata, + krb5_data *salt, krb5_data *s2kparams, + krb5_enctype *etype, krb5_keyblock *as_key, + krb5_prompter_fct prompter, void *prompter_data, + krb5_gic_get_as_key_fct gak_fct, void *gak_data, + krb5_preauth_client_rock *get_data_rock); +krb5_error_code KRB5_CALLCONV krb5_do_preauth_tryagain + (krb5_context context, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data **in_padata, krb5_pa_data ***out_padata, + krb5_error *err_reply, + krb5_data *salt, krb5_data *s2kparams, + krb5_enctype *etype, krb5_keyblock *as_key, + krb5_prompter_fct prompter, void *prompter_data, + krb5_gic_get_as_key_fct gak_fct, void *gak_data, + krb5_preauth_client_rock *get_data_rock); +void KRB5_CALLCONV krb5_init_preauth_context + (krb5_context); +void KRB5_CALLCONV krb5_free_preauth_context + (krb5_context); +void KRB5_CALLCONV krb5_clear_preauth_context_use_counts + (krb5_context); +void KRB5_CALLCONV krb5_preauth_prepare_request + (krb5_context, krb5_get_init_creds_opt *, krb5_kdc_req *); +void KRB5_CALLCONV krb5_preauth_request_context_init + (krb5_context); +void KRB5_CALLCONV krb5_preauth_request_context_fini + (krb5_context); void KRB5_CALLCONV krb5_free_sam_challenge (krb5_context, krb5_sam_challenge * ); @@ -1059,6 +1174,10 @@ struct _krb5_context { struct krb5plugin_service_locate_ftable *vtbl; void (**locate_fptrs)(void); + /* preauth module stuff */ + struct plugin_dir_handle preauth_plugins; + krb5_preauth_context *preauth_context; + /* error detail info */ struct errinfo err; }; --- krb5/src/include/kdb.h +++ krb5/src/include/kdb.h @@ -171,6 +171,7 @@ typedef struct __krb5_key_salt_tuple { #define KRB5_TL_SECURID_STATE 0x0006 #define KRB5_TL_DB_ARGS 0x7fff #endif /* SECURID */ +#define KRB5_TL_USER_CERTIFICATE 0x0007 /* * Determines the number of failed KDC requests before DISALLOW_ALL_TIX is set --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/include/krb5/preauth_plugin.h @@ -0,0 +1,326 @@ +/* + * <krb5/preauth_plugin.h> + * + * Copyright (c) 2006 Red Hat, Inc. + * Portions copyright (c) 2006 Massachusetts Institute of Technology + * All Rights Reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * * Neither the name of Red Hat, Inc., nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER + * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * Preauthentication plugin definitions for Kerberos 5. + */ + +#ifndef KRB5_PREAUTH_PLUGIN_H_INCLUDED +#define KRB5_PREAUTH_PLUGIN_H_INCLUDED +#include <krb5/krb5.h> + +/* + * While arguments of these types are passed-in, for the most part a preauth + * module can treat them as opaque. If we need keying data, we can ask for + * it directly. + */ +struct _krb5_db_entry_new; +struct _krb5_key_data; +struct _krb5_preauth_client_rock; + +/* + * Preauth mechanism property flags, unified from previous definitions in the + * KDC and libkrb5 sources. + */ + +/* Provides a real answer which we can send back to the KDC (client-only). The + * client assumes that one real answer will be enough. */ +#define PA_REAL 0x00000001 + +/* Doesn't provide a real answer, but must be given a chance to run before any + * REAL mechanism callbacks (client-only). */ +#define PA_INFO 0x00000002 + +/* Causes the KDC to include this mechanism in a list of supported preauth + * types if the user's DB entry flags the user as requiring hardware-based + * preauthentication (server-only). */ +#define PA_HARDWARE 0x00000004 + +/* Causes the KDC to include this mechanism in a list of supported preauth + * types if the user's DB entry flags the user as requiring preauthentication, + * and to fail preauthentication if we can't verify the client data. The + * flipside of PA_SUFFICIENT (server-only). */ +#define PA_REQUIRED 0x00000008 + +/* Causes the KDC to include this mechanism in a list of supported preauth + * types if the user's DB entry flags the user as requiring preauthentication, + * and to mark preauthentication as successful if we can verify the client + * data. The flipside of PA_REQUIRED (server-only). */ +#define PA_SUFFICIENT 0x00000010 + +/* Marks this preauthentication mechanism as one which changes the key which is + * used for encrypting the response to the client. Modules which have this + * flag have their server_return_proc called before modules which do not, and + * are passed over if a previously-called module has modified the encrypting + * key (server-only). */ +#define PA_REPLACES_KEY 0x00000020 + +/* Causes the KDC to check with this preauthentication module even if the + * client has no entry in the realm database. If the module returns a success + * code, continue processing and assume that its return_padata callback will + * supply us with a key for encrypting the AS reply (server-only). */ +/* #define PA_VIRTUAL (0x00000040 | PA_REPLACES_KEY) */ + +/* Not really a padata type, so don't include it in any list of preauth types + * which gets sent over the wire. */ +#define PA_PSEUDO 0x00000080 + +/* + * A server module's callback functions are allowed to request specific types + * of information about the given client or server record or request, even + * though the database records themselves are opaque to the module. + */ +enum krb5plugin_preauth_entry_request_type { + /* The returned krb5_data item holds a DER-encoded X.509 certificate. */ + krb5plugin_preauth_entry_request_certificate = 1, + /* The returned krb5_data_item holds a krb5_deltat. */ + krb5plugin_preauth_entry_max_time_skew = 2, + /* The returned krb5_data_item holds an array of krb5_keyblock structures, + * terminated by an entry with key type = 0. + * Each keyblock should have its contents freed in turn, and then the data + * item itself should be freed. */ + krb5plugin_preauth_keys = 3, + /* The returned krb5_data_item holds the request structure, re-encoded + * using DER. Unless the client implementation is the same as the server + * implementation, there's a good chance that the result will not match + * what the client sent, so don't go creating any fatal errors if it + * doesn't match up. */ + krb5plugin_preauth_request_body = 4 +}; +typedef krb5_error_code +(*preauth_get_entry_data_proc)(krb5_context, + krb5_kdc_req *, + struct _krb5_db_entry_new *, + krb5_int32 request_type, + krb5_data **); + +/* + * A client module's callback functions are allowed to request various + * information to enable it to process a request. + */ +enum krb5plugin_preauth_client_request_type { + /* The returned krb5_data item holds the enctype used to encrypt the + * encrypted portion of the AS_REP packet. */ + krb5plugin_preauth_client_get_etype = 1, + /* Free the data returned from krb5plugin_preauth_client_req_get_etype */ + krb5plugin_preauth_client_free_etype = 2 +}; +typedef krb5_error_code +(*preauth_get_client_data_proc)(krb5_context, + struct _krb5_preauth_client_rock *, + krb5_int32 request_type, + krb5_data **); + +/* + * A callback which will obtain the user's long-term AS key by prompting the + * user for the password, then salting it properly, and so on. For the moment, + * it's identical to the get_as_key callback used inside of libkrb5, but we + * define a new typedef here instead of making the existing one public to + * isolate ourselves from potential future changes. + */ +typedef krb5_error_code +(*preauth_get_as_key_proc)(krb5_context, + krb5_principal, + krb5_enctype, + krb5_prompter_fct, + void *prompter_data, + krb5_data *salt, + krb5_data *s2kparams, + krb5_keyblock *as_key, + void *gak_data); + +/* + * The function table / structure which a preauth client module must export as + * "preauthentication_client_0_backport_1_6". If the interfaces work correctly, future + * versions of the table will add either more callbacks or more arguments to + * callbacks, and in both cases we'll be able to wrap the v0 functions. + */ +typedef struct krb5plugin_preauth_client_ftable_v0 { + /* Not-usually-visible name. */ + char *name; + + /* Pointer to zero-terminated list of pa_types which this module can + * provide services for. */ + krb5_preauthtype *pa_type_list; + + /* Pointer to zero-terminated list of enc_types which this module claims + * to add support for. */ + krb5_enctype *enctype_list; + + /* Per-plugin initialization/cleanup. The init function is called + * by libkrb5 when the plugin is loaded, and the fini function is + * called before the plugin is unloaded. Both are optional and + * may be called multiple times in case the plugin is used in + * multiple contexts. The returned context lives the lifetime of + * the krb5_context */ + krb5_error_code (*init)(krb5_context context, void **plugin_context); + void (*fini)(krb5_context context, void *plugin_context); + /* A callback which returns flags indicating if the module is a "real" or + * an "info" mechanism, and so on. This function is called for each entry + * in the client_pa_type_list. */ + int (*flags)(krb5_context context, krb5_preauthtype pa_type); + /* Per-request initialization/cleanup. The request_init function is + * called when beginning to process a get_init_creds request and the + * request_fini function is called when processing of the request is + * complete. This is optional. It may be called multiple times in + * the lifetime of a krb5_context. */ + void (*request_init)(krb5_context context, void *plugin_context, + void **request_context); + void (*request_fini)(krb5_context context, void *plugin_context, + void *request_context); + /* Client function which processes server-supplied data in pa_data, + * returns created data in out_pa_data, storing any of its own state in + * client_context if data for the associated preauthentication type is + * needed. It is also called after the AS-REP is received if the AS-REP + * includes preauthentication data of the associated type. + * NOTE! the encoded_previous_request will be NULL the first time this + * function is called, because it is expected to only ever contain the data + * obtained from a previous call to this function. */ + krb5_error_code (*process)(krb5_context context, + void *plugin_context, + void *request_context, + preauth_get_client_data_proc get_data_proc, + struct _krb5_preauth_client_rock *rock, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data *pa_data, + krb5_prompter_fct prompter, + void *prompter_data, + preauth_get_as_key_proc gak_fct, + void *gak_data, + krb5_data *salt, krb5_data *s2kparams, + krb5_keyblock *as_key, + krb5_pa_data **out_pa_data); + /* Client function which can attempt to use e-data in the error response to + * try to recover from the given error. If this function is not NULL, and + * it stores data in out_pa_data which is different data from the contents + * of in_pa_data, then the client library will retransmit the request. */ + krb5_error_code (*tryagain)(krb5_context context, + void *plugin_context, + void *request_context, + preauth_get_client_data_proc get_data_proc, + struct _krb5_preauth_client_rock *rock, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data *in_pa_data, + krb5_error *error, + krb5_prompter_fct prompter, + void *prompter_data, + preauth_get_as_key_proc gak_fct, + void *gak_data, + krb5_data *salt, krb5_data *s2kparams, + krb5_keyblock *as_key, + krb5_pa_data **out_pa_data); +} krb5plugin_preauth_client_ftable_v0; + +/* + * The function table / structure which a preauth server module must export as + * "preauthentication_server_0_backport_1_6". NOTE: replace "0" with "1" for the type and + * variable names if this gets picked up by upstream. If the interfaces work + * correctly, future versions of the table will add either more callbacks or + * more arguments to callbacks, and in both cases we'll be able to wrap the v0 + * functions. + */ +typedef struct krb5plugin_preauth_server_ftable_v0 { + /* Not-usually-visible name. */ + char *name; + + /* Pointer to zero-terminated list of pa_types which this module can + * provide services for. */ + krb5_preauthtype *pa_type_list; + + /* Per-plugin initialization/cleanup. The init function is called by the + * KDC when the plugin is loaded, and the fini function is called before + * the plugin is unloaded. Both are optional. */ + krb5_error_code (*init_proc)(krb5_context, void **); + void (*fini_proc)(krb5_context, void *); + /* Return the flags which the KDC should use for this module. This is a + * callback instead of a static value because the module may or may not + * wish to count itself as a hardware preauthentication module (in other + * words, the flags may be affected by the configuration, for example if a + * site administrator can force a particular preauthentication type to be + * supported using only hardware). This function is called for each entry + * entry in the server_pa_type_list. */ + int (*flags_proc)(krb5_context, krb5_preauthtype); + /* Get preauthentication data to send to the client as part of the "you + * need to use preauthentication" error. The module doesn't need to + * actually provide data if the protocol doesn't require it, but it should + * return either zero or non-zero to control whether its padata type is + * included in the list which is sent back to the client. Is not allowed + * to create a context because we have no guarantee that the client will + * ever call again (or that it will hit this server if it does), in which + * case a context might otherwise hang around forever. */ + krb5_error_code (*edata_proc)(krb5_context, krb5_kdc_req *request, + struct _krb5_db_entry_new *client, + struct _krb5_db_entry_new *server, + preauth_get_entry_data_proc, + void *pa_module_context, + krb5_pa_data *data); + /* Verify preauthentication data sent by the client, setting the + * TKT_FLG_PRE_AUTH or TKT_FLG_HW_AUTH flag in the enc_tkt_reply's "flags" + * field as appropriate, and returning nonzero on failure. Can create + * context data for consumption by the return_proc or freepa_proc below. */ + krb5_error_code (*verify_proc)(krb5_context, + struct _krb5_db_entry_new *client, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_enc_tkt_part *enc_tkt_reply, + krb5_pa_data *data, + preauth_get_entry_data_proc, + void *pa_module_context, + void **pa_request_context, + krb5_data **e_data); + /* Generate preauthentication response data to send to the client as part + * of the AS-REP. If it needs to override the key which is used to encrypt + * the response, it can do so. The module is expected (but not required, + * if a freepa_proc is also provided) to free any context data it saved in + * "request_pa_context". */ + krb5_error_code (*return_proc)(krb5_context, krb5_pa_data * padata, + struct _krb5_db_entry_new *client, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_kdc_rep *reply, + struct _krb5_key_data *client_keys, + krb5_keyblock *encrypting_key, + krb5_pa_data **send_pa, + preauth_get_entry_data_proc, + void *pa_module_context, + void **pa_request_context); + /* Free up the server-side per-request context, in cases where + * server_return_proc() didn't or for whatever reason was not called. Can + * be NULL. */ + krb5_error_code (*freepa_reqcontext_proc)(krb5_context, + void *pa_module_context, + void **request_pa_context); +} krb5plugin_preauth_server_ftable_v0; +#endif /* KRB5_PREAUTH_PLUGIN_H_INCLUDED */ --- krb5/src/config/pre.in +++ krb5/src/config/pre.in @@ -194,6 +194,7 @@ prefix=@prefix@ INSTALL_PREFIX=$(prefix) INSTALL_EXEC_PREFIX=@exec_prefix@ exec_prefix=@exec_prefix@ +datarootdir=@datarootdir@ SHLIB_TAIL_COMP=@SHLIB_TAIL_COMP@ datadir = @datadir@ @@ -212,6 +213,7 @@ KRB5_SHLIBDIR = @libdir@$(SHLIB_TAIL_COM KRB5_INCDIR = @includedir@ MODULE_DIR = @libdir@/krb5/plugins KRB5_DB_MODULE_DIR = $(MODULE_DIR)/kdb +KRB5_PA_MODULE_DIR = $(MODULE_DIR)/preauth KRB5_LIBKRB5_MODULE_DIR = $(MODULE_DIR)/libkrb5 KRB5_INCSUBDIRS = \ $(KRB5_INCDIR)/krb5 \ --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/plugins/preauth/wpse/configure.in @@ -0,0 +1,14 @@ +K5_AC_INIT(configure.in) +enable_shared=yes +build_dynobj=yes +CONFIG_RULES + +AC_CHECK_HEADERS(errno.h string.h) + +KRB5_RUN_FLAGS +dnl The following is for check... +KRB5_BUILD_PROGRAM +KRB5_BUILD_LIBOBJS +KRB5_BUILD_LIBRARY_WITH_DEPS +AC_CONFIG_HEADERS(config.h) +V5_AC_OUTPUT_MAKEFILE --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/plugins/preauth/wpse/Makefile.in @@ -0,0 +1,42 @@ +thisconfigdir=. +myfulldir=plugins/preauth/wpse +mydir=. +BUILDTOP=$(REL)..$(S)..$(S).. +KRB5_RUN_ENV = @KRB5_RUN_ENV@ +KRB5_CONFIG_SETUP = KRB5_CONFIG=$(SRCTOP)/config-files/krb5.conf ; export KRB5_CONFIG ; +PROG_LIBPATH=-L$(TOPLIBD) +PROG_RPATH=$(KRB5_LIBDIR) +MODULE_INSTALL_DIR = $(KRB5_PA_MODULE_DIR) +DEFS=@DEFS@ + +LOCALINCLUDES = -I../../../include/krb5 -I. + +LIBBASE=wpse +LIBMAJOR=0 +LIBMINOR=0 +SO_EXT=.so +RELDIR=../plugins/preauth/wpse +# Depends on libk5crypto and libkrb5 +SHLIB_EXPDEPS = \ + $(TOPLIBD)/libk5crypto$(SHLIBEXT) \ + $(TOPLIBD)/libkrb5$(SHLIBEXT) +SHLIB_EXPLIBS= -lkrb5 -lcom_err -lk5crypto $(SUPPORT_LIB) $(LIBS) + +SHLIB_DIRS=-L$(TOPLIBD) +SHLIB_RDIRS=$(KRB5_LIBDIR) +STOBJLISTS=OBJS.ST +STLIBOBJS=wpse_main.o + +SRCS=wpse_main.c + +all-unix:: $(LIBBASE)$(SO_EXT) +install-unix:: install-libs +clean-unix:: clean-libs clean-libobjs + +clean:: + $(RM) lib$(LIBBASE)$(SO_EXT) + +@libnover_frag@ +@libobj_frag@ + +# +++ Dependency line eater +++ --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/plugins/preauth/wpse/wpse_main.c @@ -0,0 +1,393 @@ +/* + * Copyright (C) 2006 Red Hat, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * * Neither the name of Red Hat, Inc., nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER + * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/* Worst. Preauthentication. Scheme. Ever. */ + +#ident "$Id: krb5-1.5.1-1.6-pal.patch,v 1.1 2007/01/13 00:28:49 nalin Exp $" + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#ifdef HAVE_ERRNO_H +#include <errno.h> +#endif +#ifdef HAVE_STRING_H +#include <string.h> +#endif + +#include <arpa/inet.h> +#include <stdio.h> + +#include <krb5/krb5.h> +#include <krb5/preauth_plugin.h> + +/* This is not a standardized value. It's defined here only to make it easier + * to change in this module. */ +#define KRB5_PADATA_WPSE_REQ 131 + +static int +client_get_flags(krb5_context kcontext, krb5_preauthtype pa_type) +{ + return PA_REAL; +} + +static krb5_error_code +client_init(krb5_context kcontext, void **ctx) +{ + int *pctx; + + pctx = malloc(sizeof(int)); + if (pctx == NULL) + return ENOMEM; + *pctx = 0; + *ctx = pctx; + return 0; +} + +static void +client_fini(krb5_context kcontext, void *ctx) +{ + int *pctx; + + pctx = ctx; + if (pctx) { +#ifdef DEBUG + fprintf(stderr, "wpse module called total of %d times\n", *pctx); +#endif + free(pctx); + } +} + +static krb5_error_code +client_process(krb5_context kcontext, + void *plugin_context, + void *request_context, + preauth_get_client_data_proc client_get_data_proc, + struct _krb5_preauth_client_rock *rock, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data *pa_data, + krb5_prompter_fct prompter, + void *prompter_data, + preauth_get_as_key_proc gak_fct, + void *gak_data, + krb5_data *salt, krb5_data *s2kparams, + krb5_keyblock *as_key, + krb5_pa_data **out_pa_data) +{ + krb5_pa_data *send_pa; + krb5_int32 nnonce, enctype; + krb5_keyblock *kb; + krb5_error_code status; + int *pctx; + +#ifdef DEBUG + fprintf(stderr, "%d bytes of preauthentication data (type %d)\n", + pa_data->length, pa_data->pa_type); +#endif + + pctx = plugin_context; + if (pctx) { + (*pctx)++; + } + + if (pa_data->length == 0) { + /* Create preauth data. */ + send_pa = malloc(sizeof(krb5_pa_data)); + if (send_pa == NULL) + return ENOMEM; + send_pa->pa_type = KRB5_PADATA_WPSE_REQ; + send_pa->length = 4; + send_pa->contents = malloc(4); + if (send_pa->contents == NULL) { + free(send_pa); + return ENOMEM; + } + /* Store the preauth data. */ + nnonce = htonl(request->nonce); + memcpy(send_pa->contents, &nnonce, 4); + *out_pa_data = send_pa; + } else { + /* A reply from the KDC. Conventionally this would be + * indicated by a different preauthentication type, but this + * mechanism/implementation doesn't do that. */ + if (pa_data->length > 4) { + memcpy(&enctype, pa_data->contents, 4); + kb = NULL; + status = krb5_init_keyblock(kcontext, ntohl(enctype), + pa_data->length - 4, &kb); + if (status != 0) + return status; + memcpy(kb->contents, pa_data->contents + 4, pa_data->length - 4); +#ifdef DEBUG + fprintf(stderr, "Recovered key type=%d, length=%d.\n", + kb->enctype, kb->length); +#endif + status = krb5_copy_keyblock_contents(kcontext, kb, as_key); + krb5_free_keyblock(kcontext, kb); + return status; + } + return KRB5KRB_ERR_GENERIC; + } + return 0; +} + +#define WPSE_MAGIC 0x77707365 +typedef struct _wpse_req_ctx +{ + int magic; + int value; +} wpse_req_ctx; + +static void +client_req_init(krb5_context kcontext, void *plugin_context, void **req_context_p) +{ + wpse_req_ctx *ctx; + + *req_context_p = NULL; + + /* Allocate a request context. Useful for verifying that we do in fact + * do per-request cleanup. */ + ctx = (wpse_req_ctx *) malloc(sizeof(*ctx)); + if (ctx == NULL) + return; + ctx->magic = WPSE_MAGIC; + ctx->value = 0xc0dec0de; + + *req_context_p = ctx; +} + +static void +client_req_cleanup(krb5_context kcontext, void *plugin_context, void *req_context) +{ + wpse_req_ctx *ctx = (wpse_req_ctx *)req_context; + + if (ctx) { +#ifdef DEBUG + fprintf(stderr, "client_req_cleanup: req_ctx at %p has magic %x and value %x\n", + ctx, ctx->magic, ctx->value); +#endif + if (ctx->magic != WPSE_MAGIC) { +#ifdef DEBUG + fprintf(stderr, "client_req_cleanup: req_context at %p has bad magic value %x\n", + ctx, ctx->magic); +#endif + return; + } + free(ctx); + } + return; +} + +/* Free state. */ +static krb5_error_code +server_free_pa_request_context(krb5_context kcontext, void *plugin_context, + void **request_context) +{ + if (*request_context != NULL) { + free(*request_context); + *request_context = NULL; + } + return 0; +} + +/* Obtain and return any preauthentication data (which is destined for the + * client) which matches type data->pa_type. */ +static krb5_error_code +server_get_edata(krb5_context kcontext, + krb5_kdc_req *request, + struct _krb5_db_entry_new *client, + struct _krb5_db_entry_new *server, + preauth_get_entry_data_proc server_get_entry_data, + void *pa_module_context, + krb5_pa_data *data) +{ + /* Return zero bytes of data. */ + data->length = 0; + data->contents = NULL; + return 0; +} + +/* Verify a request from a client. */ +static krb5_error_code +server_verify(krb5_context kcontext, + struct _krb5_db_entry_new *client, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_enc_tkt_part *enc_tkt_reply, + krb5_pa_data *data, + preauth_get_entry_data_proc server_get_entry_data, + void *pa_module_context, + void **pa_request_context, + krb5_data **e_data) +{ + krb5_int32 nnonce; + krb5_data *test_edata; + + /* Verify the preauth data. */ + if (data->length != 4) + return KRB5KDC_ERR_PREAUTH_FAILED; + memcpy(&nnonce, data->contents, 4); + nnonce = ntohl(nnonce); + if (memcmp(&nnonce, &request->nonce, 4) != 0) + return KRB5KDC_ERR_PREAUTH_FAILED; + /* Note that preauthentication succeeded. */ + enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH; + enc_tkt_reply->flags |= TKT_FLG_HW_AUTH; + /* Allocate a context. Useful for verifying that we do in fact do + * per-request cleanup. */ + if (*pa_request_context == NULL) + *pa_request_context = malloc(4); + + /* Return edata to exercise code that handles edata... */ + test_edata = malloc(sizeof(*test_edata)); + if (test_edata != NULL) { + test_edata->data = malloc(20); + if (test_edata->data == NULL) { + free(test_edata); + } else { + test_edata->length = 20; + memset(test_edata->data, '#', 20); /* fill it with junk */ + *e_data = test_edata; + } + } + return 0; +} + +/* Create the response for a client. */ +static krb5_error_code +server_return(krb5_context kcontext, + krb5_pa_data *padata, + struct _krb5_db_entry_new *client, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_kdc_rep *reply, + struct _krb5_key_data *client_key, + krb5_keyblock *encrypting_key, + krb5_pa_data **send_pa, + preauth_get_entry_data_proc server_get_entry_data, + void *pa_module_context, + void **pa_request_context) +{ + /* This module does a couple of dumb things. It tags its reply with + * the same type as the initial challenge (expecting the client to sort + * out whether there's anything useful in there). Oh, and it replaces + * the AS reply key with one which is sent in the clear. */ + krb5_keyblock *kb; + krb5_int32 enctype; + int i; + + *send_pa = NULL; + + /* We'll want a key with the first supported enctype. */ + for (i = 0; i < request->nktypes; i++) { + kb = NULL; + if (krb5_init_keyblock(kcontext, request->ktype[i], 0, &kb) == 0) { + break; + } + } + if (i >= request->nktypes) { + /* No matching cipher type found. */ + return 0; + } + + /* Randomize a key and save it for the client. */ + if (krb5_c_make_random_key(kcontext, request->ktype[i], kb) != 0) { + krb5_free_keyblock(kcontext, kb); + return 0; + } +#ifdef DEBUG + fprintf(stderr, "Generated random key, type=%d, length=%d.\n", + kb->enctype, kb->length); +#endif + + *send_pa = malloc(sizeof(krb5_pa_data)); + if (*send_pa == NULL) { + krb5_free_keyblock(kcontext, kb); + return ENOMEM; + } + (*send_pa)->pa_type = KRB5_PADATA_WPSE_REQ; + (*send_pa)->length = 4 + kb->length; + (*send_pa)->contents = malloc(4 + kb->length); + if ((*send_pa)->contents == NULL) { + free(*send_pa); + *send_pa = NULL; + krb5_free_keyblock(kcontext, kb); + return ENOMEM; + } + + /* Store the preauth data. */ + enctype = htonl(kb->enctype); + memcpy((*send_pa)->contents, &enctype, 4); + memcpy((*send_pa)->contents + 4, kb->contents, kb->length); + krb5_free_keyblock_contents(kcontext, encrypting_key); + krb5_copy_keyblock_contents(kcontext, kb, encrypting_key); + + /* Clean up. */ + krb5_free_keyblock(kcontext, kb); + + return 0; +} + +static int +server_get_flags(krb5_context kcontext, krb5_preauthtype pa_type) +{ + return PA_HARDWARE | PA_REPLACES_KEY; +} + +static krb5_preauthtype supported_client_pa_types[] = {KRB5_PADATA_WPSE_REQ, 0}; +static krb5_preauthtype supported_server_pa_types[] = {KRB5_PADATA_WPSE_REQ, 0}; + +struct krb5plugin_preauth_client_ftable_v0 preauthentication_client_0_backport_1_6 = { + "wpse", /* name */ + &supported_client_pa_types[0], /* pa_type_list */ + NULL, /* enctype_list */ + client_init, /* plugin init function */ + client_fini, /* plugin fini function */ + client_get_flags, /* get flags function */ + client_req_init, /* request init function */ + client_req_cleanup, /* request fini function */ + client_process, /* process function */ + NULL, /* try_again function */ +}; + +struct krb5plugin_preauth_server_ftable_v0 preauthentication_server_0_backport_1_6 = { + "wpse", + &supported_server_pa_types[0], + NULL, + NULL, + server_get_flags, + server_get_edata, + server_verify, + server_return, + server_free_pa_request_context, +}; --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/plugins/preauth/wpse/wpse.exports @@ -0,0 +1,2 @@ +preauthentication_client_0_backport_1_6 +preauthentication_server_0_backport_1_6 --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/plugins/preauth/cksum_body/cksum_body.exports @@ -0,0 +1,2 @@ +preauthentication_client_0_backport_1_6 +preauthentication_server_0_backport_1_6 --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/plugins/preauth/cksum_body/configure.in @@ -0,0 +1,14 @@ +K5_AC_INIT(configure.in) +enable_shared=yes +build_dynobj=yes +CONFIG_RULES + +AC_CHECK_HEADERS(errno.h string.h) + +KRB5_RUN_FLAGS +dnl The following is for check... +KRB5_BUILD_PROGRAM +KRB5_BUILD_LIBOBJS +KRB5_BUILD_LIBRARY_WITH_DEPS +AC_CONFIG_HEADERS(config.h) +V5_AC_OUTPUT_MAKEFILE --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/plugins/preauth/cksum_body/Makefile.in @@ -0,0 +1,42 @@ +thisconfigdir=. +myfulldir=plugins/preauth/cksum_body +mydir=. +BUILDTOP=$(REL)..$(S)..$(S).. +KRB5_RUN_ENV = @KRB5_RUN_ENV@ +KRB5_CONFIG_SETUP = KRB5_CONFIG=$(SRCTOP)/config-files/krb5.conf ; export KRB5_CONFIG ; +PROG_LIBPATH=-L$(TOPLIBD) +PROG_RPATH=$(KRB5_LIBDIR) +MODULE_INSTALL_DIR = $(KRB5_PA_MODULE_DIR) +DEFS=@DEFS@ + +LOCALINCLUDES = -I../../../include/krb5 -I. + +LIBBASE=cksum_body +LIBMAJOR=0 +LIBMINOR=0 +SO_EXT=.so +RELDIR=../plugins/preauth/cksum_body +# Depends on libk5crypto and libkrb5 +SHLIB_EXPDEPS = \ + $(TOPLIBD)/libk5crypto$(SHLIBEXT) \ + $(TOPLIBD)/libkrb5$(SHLIBEXT) +SHLIB_EXPLIBS= -lkrb5 -lcom_err -lk5crypto $(SUPPORT_LIB) $(LIBS) + +SHLIB_DIRS=-L$(TOPLIBD) +SHLIB_RDIRS=$(KRB5_LIBDIR) +STOBJLISTS=OBJS.ST +STLIBOBJS=cksum_body_main.o + +SRCS= $(srcdir)/cksum_body_main.c + +all-unix:: $(LIBBASE)$(SO_EXT) +install-unix:: install-libs +clean-unix:: clean-libs clean-libobjs + +clean:: + $(RM) lib$(LIBBASE)$(SO_EXT) + +@libnover_frag@ +@libobj_frag@ + +# +++ Dependency line eater +++ --- /dev/null 2007-01-10 09:59:42.964619257 -0500 +++ krb5/src/plugins/preauth/cksum_body/cksum_body_main.c @@ -0,0 +1,521 @@ +/* + * Copyright (C) 2006 Red Hat, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * * Neither the name of Red Hat, Inc., nor the names of its + * contributors may be used to endorse or promote products derived + * from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS + * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED + * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER + * OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/* + * Checksum the request body with the user's long-term key. + * + * The e-data from the KDC is a list of network-byte-order 32-bit integers + * listing key types which the KDC has for the user. + * + * The client uses one of these key types to generate a checksum over the body + * of the request, and includes the checksum in the AS-REQ as preauthentication + * data. + * + * The AS-REP carries no preauthentication data for this scheme. + */ + +#ident "$Id: krb5-1.5.1-1.6-pal.patch,v 1.1 2007/01/13 00:28:49 nalin Exp $" + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#ifdef HAVE_ERRNO_H +#include <errno.h> +#endif +#ifdef HAVE_STRING_H +#include <string.h> +#endif + +#include <arpa/inet.h> +#include <stdio.h> + +#include <krb5/krb5.h> +#include <krb5/preauth_plugin.h> + +/* This is not a standardized value. It's defined here only to make it easier + * to change in this module. */ +#define KRB5_PADATA_CKSUM_BODY_REQ 130 + +struct server_stats{ + int successes, failures; +}; + +static int +client_get_flags(krb5_context kcontext, krb5_preauthtype pa_type) +{ + return PA_REAL; +} + +static krb5_error_code +client_process(krb5_context kcontext, + void *client_plugin_context, + void *client_request_context, + preauth_get_client_data_proc client_get_data_proc, + struct _krb5_preauth_client_rock *rock, + krb5_kdc_req *request, + krb5_data *encoded_request_body, + krb5_data *encoded_previous_request, + krb5_pa_data *pa_data, + krb5_prompter_fct prompter, + void *prompter_data, + preauth_get_as_key_proc gak_fct, + void *gak_data, + krb5_data *salt, krb5_data *s2kparams, + krb5_keyblock *as_key, + krb5_pa_data **out_pa_data) +{ + krb5_pa_data *send_pa; + krb5_checksum checksum; + krb5_enctype enctype; + krb5_cksumtype *cksumtypes; + krb5_error_code status = 0; + krb5_int32 cksumtype, *enctypes; + unsigned int i, n_enctypes, cksumtype_count; + + memset(&checksum, 0, sizeof(checksum)); + + /* Get the user's long-term key if we haven't asked for it yet. Try + * all of the encryption types which the server supports. */ + if (as_key->length == 0) { + if ((pa_data != NULL) && (pa_data->length >= 4)) { +#ifdef DEBUG + fprintf(stderr, "%d bytes of preauth data.\n", pa_data->length); +#endif + n_enctypes = pa_data->length / 4; + enctypes = (krb5_int32*) pa_data->contents; + } else { + n_enctypes = request->nktypes; + } + for (i = 0; i < n_enctypes; i++) { + if ((pa_data != NULL) && (pa_data->length >= 4)) { + memcpy(&enctype, pa_data->contents + 4 * i, 4); + enctype = ntohl(enctype); + } else { + enctype = request->ktype[i]; + } +#ifdef DEBUG + fprintf(stderr, "Asking for AS key (type = %d).\n", enctype); +#endif + status = (*gak_fct)(kcontext, request->client, enctype, + prompter, prompter_data, + salt, s2kparams, as_key, gak_data); + if (status == 0) + break; + } + if (status != 0) + return status; + } +#ifdef DEBUG + fprintf(stderr, "Got AS key (type = %d).\n", as_key->enctype); +#endif + + /* Determine an appropriate checksum type for this key. */ + cksumtype_count = 0; + cksumtypes = NULL; + status = krb5_c_keyed_checksum_types(kcontext, as_key->enctype, + &cksumtype_count, &cksumtypes); + if (status != 0) + return status; + + /* Generate the checksum. */ + for (i = 0; i < cksumtype_count; i++) { + status = krb5_c_make_checksum(kcontext, cksumtypes[i], as_key, + KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM, + encoded_request_body, + &checksum); + if (status == 0) { +#ifdef DEBUG + fprintf(stderr, "Made checksum (type = %d, %d bytes).\n", + checksum.checksum_type, encoded_request_body->length); +#endif + break; + } + } + cksumtype = htonl(cksumtypes[i]); + krb5_free_cksumtypes(kcontext, cksumtypes); + if (status != 0) { + if (checksum.length > 0) + krb5_free_checksum_contents(kcontext, &checksum); + return status; + } + + /* Allocate the preauth data structure. */ + send_pa = malloc(sizeof(krb5_pa_data)); + if (send_pa == NULL) { + krb5_free_checksum_contents(kcontext, &checksum); + return ENOMEM; + } + send_pa->pa_type = KRB5_PADATA_CKSUM_BODY_REQ; + send_pa->length = 4 + checksum.length; + send_pa->contents = malloc(4 + checksum.length); + if (send_pa->contents == NULL) { + krb5_free_checksum_contents(kcontext, &checksum); + free(send_pa); + return ENOMEM; + } + + /* Store the checksum. */ + memcpy(send_pa->contents, &cksumtype, 4); + memcpy(send_pa->contents + 4, checksum.contents, checksum.length); + *out_pa_data = send_pa; + + /* Clean up. */ + krb5_free_checksum_contents(kcontext, &checksum); + + return 0; +} + +/* Initialize and tear down the server-side module, and do stat tracking. */ +static krb5_error_code +server_init(krb5_context kcontext, void **module_context) +{ + struct server_stats *stats; + stats = malloc(sizeof(struct server_stats)); + if (stats == NULL) + return ENOMEM; + stats->successes = 0; + stats->failures = 0; + *module_context = stats; + return 0; +} +static void +server_fini(krb5_context kcontext, void *module_context) +{ + struct server_stats *stats; + stats = module_context; + if (stats != NULL) { +#ifdef DEBUG + fprintf(stderr, "Total: %d clients failed, %d succeeded.\n", + stats->failures, stats->successes); +#endif + free(stats); + } +} + +/* Obtain and return any preauthentication data (which is destined for the + * client) which matches type data->pa_type. */ +static krb5_error_code +server_get_edata(krb5_context kcontext, + krb5_kdc_req *request, + struct _krb5_db_entry_new *client, + struct _krb5_db_entry_new *server, + preauth_get_entry_data_proc server_get_entry_data, + void *pa_module_context, + krb5_pa_data *data) +{ + krb5_data *key_data; + krb5_keyblock *keys, *key; + krb5_int32 *enctypes, enctype; + int i; + + /* Retrieve the client's keys. */ + key_data = NULL; + if ((*server_get_entry_data)(kcontext, request, client, + krb5plugin_preauth_keys, &key_data) != 0) { +#ifdef DEBUG + fprintf(stderr, "Error retrieving client keys.\n"); +#endif + return KRB5KDC_ERR_PADATA_TYPE_NOSUPP; + } + + /* Count which types of keys we've got, freeing the contents, which we + * don't need at this point. */ + keys = (krb5_keyblock *) key_data->data; + key = NULL; + for (i = 0; keys[i].enctype != 0; i++) + krb5_free_keyblock_contents(kcontext, &keys[i]); + + /* Return the list of encryption types. */ + enctypes = malloc((unsigned)i * 4); + if (enctypes == NULL) { + krb5_free_data(kcontext, key_data); + return ENOMEM; + } +#ifdef DEBUG + fprintf(stderr, "Supported enctypes = {"); +#endif + for (i = 0; keys[i].enctype != 0; i++) { +#ifdef DEBUG + fprintf(stderr, "%s%d", (i > 0) ? ", " : "", keys[i].enctype); +#endif + enctype = htonl(keys[i].enctype); + memcpy(&enctypes[i], &enctype, 4); + } +#ifdef DEBUG + fprintf(stderr, "}.\n"); +#endif + data->pa_type = KRB5_PADATA_CKSUM_BODY_REQ; + data->length = (i * 4); + data->contents = (unsigned char *) enctypes; + krb5_free_data(kcontext, key_data); + return 0; +} + +/* Verify a request from a client. */ +static krb5_error_code +server_verify(krb5_context kcontext, + struct _krb5_db_entry_new *client, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_enc_tkt_part *enc_tkt_reply, + krb5_pa_data *data, + preauth_get_entry_data_proc server_get_entry_data, + void *pa_module_context, + void **pa_request_context, + krb5_data **e_data) +{ + krb5_int32 cksumtype; + krb5_checksum checksum; + krb5_boolean valid; + krb5_data *key_data, *req_body; + krb5_keyblock *keys, *key; + size_t length; + int i; + unsigned int j, cksumtypes_count; + krb5_cksumtype *cksumtypes; + krb5_error_code status; + struct server_stats *stats; + krb5_data *test_edata; + + stats = pa_module_context; + + /* Verify the preauth data. Start with the checksum type. */ + if (data->length < 4) { + stats->failures++; + return KRB5KDC_ERR_PREAUTH_FAILED; + } + memcpy(&cksumtype, data->contents, 4); + memset(&checksum, 0, sizeof(checksum)); + checksum.checksum_type = ntohl(cksumtype); + + /* Verify that the amount of data we have left is what we expect. */ + if (krb5_c_checksum_length(kcontext, checksum.checksum_type, + &length) != 0) { +#ifdef DEBUG + fprintf(stderr, "Error determining checksum size (type = %d). " + "Is it supported?\n", checksum.checksum_type); +#endif + stats->failures++; + return KRB5KDC_ERR_SUMTYPE_NOSUPP; + } + if (data->length - 4 != length) { +#ifdef DEBUG + fprintf(stderr, "Checksum size doesn't match client packet size.\n"); +#endif + stats->failures++; + return KRB5KDC_ERR_PREAUTH_FAILED; + } + checksum.length = length; + + /* Pull up the client's keys. */ + key_data = NULL; + if ((*server_get_entry_data)(kcontext, request, client, + krb5plugin_preauth_keys, &key_data) != 0) { +#ifdef DEBUG + fprintf(stderr, "Error retrieving client keys.\n"); +#endif + stats->failures++; + return KRB5KDC_ERR_PREAUTH_FAILED; + } + + /* Find the key which would have been used to generate the checksum. */ + keys = (krb5_keyblock *) key_data->data; + key = NULL; + for (i = 0; keys[i].enctype != 0; i++) { + key = &keys[i]; + cksumtypes_count = 0; + cksumtypes = NULL; + if (krb5_c_keyed_checksum_types(kcontext, key->enctype, + &cksumtypes_count, &cksumtypes) != 0) + continue; + for (j = 0; j < cksumtypes_count; j++) { + if (cksumtypes[j] == checksum.checksum_type) + break; + } + if (cksumtypes != NULL) + krb5_free_cksumtypes(kcontext, cksumtypes); + if (j < cksumtypes_count) { +#ifdef DEBUG + fprintf(stderr, "Found checksum key.\n"); +#endif + break; + } + } + if ((key == NULL) || (key->enctype == 0)) { + for (i = 0; keys[i].enctype != 0; i++) + krb5_free_keyblock_contents(kcontext, &keys[i]); + krb5_free_data(kcontext, key_data); + stats->failures++; + return KRB5KDC_ERR_SUMTYPE_NOSUPP; + } + + /* Save a copy of the key. */ + if (krb5_copy_keyblock(kcontext, &keys[i], &key) != 0) { + for (i = 0; keys[i].enctype != 0; i++) + krb5_free_keyblock_contents(kcontext, &keys[i]); + krb5_free_data(kcontext, key_data); + stats->failures++; + return KRB5KDC_ERR_SUMTYPE_NOSUPP; + } + for (i = 0; keys[i].enctype != 0; i++) + krb5_free_keyblock_contents(kcontext, &keys[i]); + krb5_free_data(kcontext, key_data); + + /* Rebuild a copy of the client's request-body. If we were serious + * about doing this with any chance of working interoperability, we'd + * extract the structure directly from the req_pkt structure. This + * will probably work if it's us on both ends, though. */ + req_body = NULL; + if ((*server_get_entry_data)(kcontext, request, client, + krb5plugin_preauth_request_body, + &req_body) != 0) { + krb5_free_keyblock(kcontext, key); + stats->failures++; + return KRB5KDC_ERR_PREAUTH_FAILED; + } + +#ifdef DEBUG + fprintf(stderr, "AS key type %d, checksum type %d, %d bytes.\n", + key->enctype, checksum.checksum_type, req_body->length); +#endif + + /* Verify the checksum itself. */ + checksum.contents = data->contents + 4; + valid = FALSE; + status = krb5_c_verify_checksum(kcontext, key, + KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM, + req_body, &checksum, &valid); + + /* Clean up. */ + krb5_free_data(kcontext, req_body); + krb5_free_keyblock(kcontext, key); + + /* Evaluate our results. */ + if ((status != 0) || (!valid)) { +#ifdef DEBUG + if (status != 0) { + fprintf(stderr, "Error in checksum verification.\n"); + } else { + fprintf(stderr, "Checksum mismatch.\n"); + } +#endif + /* Return edata to exercise code that handles edata... */ + test_edata = malloc(sizeof(*test_edata)); + if (test_edata != NULL) { + test_edata->data = malloc(20); + if (test_edata->data == NULL) { + free(test_edata); + } else { + test_edata->length = 20; + memset(test_edata->data, 'F', 20); /* fill it with junk */ + *e_data = test_edata; + } + } + stats->failures++; + return KRB5KDC_ERR_PREAUTH_FAILED; + } + + /* Return edata to exercise code that handles edata... */ + test_edata = malloc(sizeof(*test_edata)); + if (test_edata != NULL) { + test_edata->data = malloc(20); + if (test_edata->data == NULL) { + free(test_edata); + } else { + test_edata->length = 20; + memset(test_edata->data, 'S', 20); /* fill it with junk */ + *e_data = test_edata; + } + } + + /* Note that preauthentication succeeded. */ + enc_tkt_reply->flags |= TKT_FLG_PRE_AUTH; + stats->successes++; + return 0; +} + +/* Create the response for a client. */ +static krb5_error_code +server_return(krb5_context kcontext, + krb5_pa_data *padata, + struct _krb5_db_entry_new *client, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_kdc_rep *reply, + struct _krb5_key_data *client_key, + krb5_keyblock *encrypting_key, + krb5_pa_data **send_pa, + preauth_get_entry_data_proc server_get_entry_data, + void *pa_module_context, + void **pa_request_context) +{ + /* We don't need to send data back on the return trip. */ + *send_pa = NULL; + return 0; +} + +static int +server_get_flags(krb5_context kcontext, krb5_preauthtype pa_type) +{ + return PA_SUFFICIENT; +} + +static krb5_preauthtype supported_client_pa_types[] = { + KRB5_PADATA_CKSUM_BODY_REQ, 0, +}; +static krb5_preauthtype supported_server_pa_types[] = { + KRB5_PADATA_CKSUM_BODY_REQ, 0, +}; + +struct krb5plugin_preauth_client_ftable_v0 preauthentication_client_0_backport_1_6 = { + "cksum_body", /* name */ + &supported_client_pa_types[0], /* pa_type_list */ + NULL, /* enctype_list */ + NULL, /* plugin init function */ + NULL, /* plugin fini function */ + client_get_flags, /* get flags function */ + NULL, /* request init function */ + NULL, /* request fini function */ + client_process, /* process function */ + NULL, /* try_again function */ +}; + +struct krb5plugin_preauth_server_ftable_v0 preauthentication_server_0_backport_1_6 = { + "cksum_body", + &supported_server_pa_types[0], + server_init, + server_fini, + server_get_flags, + server_get_edata, + server_verify, + server_return, + NULL +}; --- krb5/src/configure.in +++ krb5/src/configure.in @@ -900,7 +900,7 @@ fi if test -n "$KRB4_LIB"; then K5_GEN_MAKEFILE(lib/krb4) fi -AC_CONFIG_SUBDIRS(lib/apputils plugins/kdb/db2 appl tests) +AC_CONFIG_SUBDIRS(lib/apputils plugins/kdb/db2 plugins/preauth/wpse plugins/preauth/cksum_body appl tests) dnl if false; then AC_CHECK_HEADERS(Python.h python2.3/Python.h) --- krb5/src/Makefile.in +++ krb5/src/Makefile.in @@ -3,8 +3,8 @@ datadir=@datadir@ thisconfigdir=. myfulldir=. mydir=. -# Don't build sample by default: plugins/locate/python -SUBDIRS=util include lib @krb524@ kdc kadmin slave clients \ +# Don't build sample by default: plugins/locate/python plugins/preauth/wpse plugins/preauth/cksum_body +SUBDIRS=util include lib @krb524@ kdc kadmin slave clients \ plugins/kdb/db2 \ appl tests \ config-files gen-manpages --- krb5/src/config-files/krb5.conf.M +++ krb5/src/config-files/krb5.conf.M @@ -156,6 +156,12 @@ libraries, use a value of 3 to use the C instead. This field is ignored when its value is incompatible with the session key type. +.IP preferred_preauth_types +This allows you to set the preferred preauthentication types which the +client will attempt before others which may be advertised by a KDC. The +default value for this setting is "17, 16, 15, 14", which forces libkrb5 +to attempt to use PKINIT if it is supported. + .IP ccache_type User this parameter on systems which are DCE clients, to specify the type of cache to be created by kinit, or when forwarded tickets are @@ -169,7 +175,7 @@ Specifies the location of the Kerberos V "/etc/srvtab". .IP krb4_config -Specifies the location of hte Kerberos V4 configuration file. Default +Specifies the location of the Kerberos V4 configuration file. Default is "/etc/krb.conf". .IP krb4_realms