static krb5_error_code
k5_insert_client_info(krb5_context context,
krb5_pac pac,
krb5_timestamp authtime,
krb5_const_principal principal)
{
krb5_error_code ret;
krb5_data client_info;
char *princ_name_utf8 = NULL;
unsigned char *princ_name_ucs2 = NULL, *p;
size_t princ_name_ucs2_len = 0;
krb5_ui_8 nt_authtime;
/* If we already have a CLIENT_INFO buffer, then just validate it */
if (k5_pac_locate_buffer(context, pac, KRB5_PAC_CLIENT_INFO,
&client_info) == 0) {
return k5_pac_validate_client(context, pac, authtime, principal);
}
ret = krb5_unparse_name_flags(context, principal,
KRB5_PRINCIPAL_UNPARSE_NO_REALM,
&princ_name_utf8);
if (ret != 0)
goto cleanup;
ret = krb5int_utf8s_to_ucs2les(princ_name_utf8,
&princ_name_ucs2,
&princ_name_ucs2_len);
if (ret != 0)
goto cleanup;
client_info.length = PAC_CLIENT_INFO_LENGTH + princ_name_ucs2_len;
client_info.data = NULL;
ret = k5_pac_add_buffer(context, pac, KRB5_PAC_CLIENT_INFO,
&client_info, TRUE, &client_info);
if (ret != 0)
goto cleanup;
p = (unsigned char *)client_info.data;
/* copy in authtime converted to a 64-bit NT time */
k5_seconds_since_1970_to_time(authtime, &nt_authtime);
store_64_le(nt_authtime, p);
p += 8;
/* copy in number of UCS-2 characters in principal name */
store_16_le(princ_name_ucs2_len, p);
p += 2;
/* copy in principal name */
memcpy(p, princ_name_ucs2, princ_name_ucs2_len);
cleanup:
if (princ_name_ucs2 != NULL)
free(princ_name_ucs2);
krb5_free_unparsed_name(context, princ_name_utf8);
return ret;
}
krb5_error_code KRB5_CALLCONV
krb5_pac_verify(krb5_context context,
const krb5_pac pac,
krb5_timestamp authtime,
krb5_const_principal principal,
const krb5_keyblock *server,
const krb5_keyblock *privsvr)
{
krb5_error_code ret;
if (server == NULL)
return EINVAL;
ret = k5_pac_verify_server_checksum(context, pac, server);
if (ret != 0)
return ret;
if (privsvr != NULL) {
ret = k5_pac_verify_kdc_checksum(context, pac, privsvr);
if (ret != 0)
return ret;
}
if (principal != NULL) {
ret = k5_pac_validate_client(context, pac, authtime, principal);
if (ret != 0)
return ret;
}
pac->verified = TRUE;
return 0;
}
