static krb5_error_code
kdc_digest(krb5_context context,
krb5_kdc_configuration *config,
krb5_data *req_buffer,
krb5_data *reply,
const char *from,
struct sockaddr *addr,
int datagram_reply,
int *claim)
{
DigestREQ digestreq;
krb5_error_code ret;
size_t len;
ret = decode_DigestREQ(req_buffer->data, req_buffer->length,
&digestreq, &len);
if (ret)
return ret;
*claim = 1;
ret = _kdc_do_digest(context, config, &digestreq, reply, from, addr);
free_DigestREQ(&digestreq);
return ret;
}
int
krb5_kdc_process_request(krb5_context context,
krb5_kdc_configuration *config,
unsigned char *buf,
size_t len,
krb5_data *reply,
krb5_boolean *prependlength,
const char *from,
struct sockaddr *addr,
int datagram_reply)
{
KDC_REQ req;
Ticket ticket;
DigestREQ digestreq;
krb5_error_code ret;
size_t i;
gettimeofday(&_kdc_now, NULL);
if(decode_AS_REQ(buf, len, &req, &i) == 0){
krb5_data req_buffer;
req_buffer.data = buf;
req_buffer.length = len;
ret = _kdc_as_rep(context, config, &req, &req_buffer,
reply, from, addr, datagram_reply);
free_AS_REQ(&req);
return ret;
}else if(decode_TGS_REQ(buf, len, &req, &i) == 0){
ret = _kdc_tgs_rep(context, config, &req, reply, from, addr);
free_TGS_REQ(&req);
return ret;
}else if(decode_Ticket(buf, len, &ticket, &i) == 0){
ret = _kdc_do_524(context, config, &ticket, reply, from, addr);
free_Ticket(&ticket);
return ret;
}else if(decode_DigestREQ(buf, len, &digestreq, &i) == 0){
ret = _kdc_do_digest(context, config, &digestreq, reply, from, addr);
free_DigestREQ(&digestreq);
return ret;
} else if(_kdc_maybe_version4(buf, len)){
*prependlength = FALSE; /* elbitapmoc sdrawkcab XXX */
_kdc_do_version4(context, config, buf, len, reply, from,
(struct sockaddr_in*)addr);
return 0;
} else if (config->enable_kaserver) {
ret = _kdc_do_kaserver(context, config, buf, len, reply, from,
(struct sockaddr_in*)addr);
return ret;
}
return -1;
}
static krb5_error_code
digest_request(krb5_context context,
krb5_realm realm,
krb5_ccache ccache,
krb5_key_usage usage,
const DigestReqInner *ireq,
DigestRepInner *irep)
{
DigestREQ req;
DigestREP rep;
krb5_error_code ret;
krb5_data data, data2;
size_t size = 0;
krb5_crypto crypto = NULL;
krb5_auth_context ac = NULL;
krb5_principal principal = NULL;
krb5_ccache id = NULL;
krb5_realm r = NULL;
krb5_data_zero(&data);
krb5_data_zero(&data2);
memset(&req, 0, sizeof(req));
memset(&rep, 0, sizeof(rep));
if (ccache == NULL) {
ret = krb5_cc_default(context, &id);
if (ret)
goto out;
} else
id = ccache;
if (realm == NULL) {
ret = krb5_get_default_realm(context, &r);
if (ret)
goto out;
} else
r = realm;
/*
*
*/
ret = krb5_make_principal(context, &principal,
r, KRB5_DIGEST_NAME, r, NULL);
if (ret)
goto out;
ASN1_MALLOC_ENCODE(DigestReqInner, data.data, data.length,
ireq, &size, ret);
if (ret) {
krb5_set_error_message(context, ret,
N_("Failed to encode digest inner request", ""));
goto out;
}
if (size != data.length)
krb5_abortx(context, "ASN.1 internal encoder error");
ret = krb5_mk_req_exact(context, &ac,
AP_OPTS_USE_SUBKEY|AP_OPTS_MUTUAL_REQUIRED,
principal, NULL, id, &req.apReq);
if (ret)
goto out;
{
krb5_keyblock *key;
ret = krb5_auth_con_getlocalsubkey(context, ac, &key);
if (ret)
goto out;
if (key == NULL) {
ret = EINVAL;
krb5_set_error_message(context, ret,
N_("Digest failed to get local subkey", ""));
goto out;
}
ret = krb5_crypto_init(context, key, 0, &crypto);
krb5_free_keyblock (context, key);
if (ret)
goto out;
}
ret = krb5_encrypt_EncryptedData(context, crypto, usage,
data.data, data.length, 0,
&req.innerReq);
if (ret)
goto out;
krb5_data_free(&data);
ASN1_MALLOC_ENCODE(DigestREQ, data.data, data.length,
&req, &size, ret);
if (ret) {
krb5_set_error_message(context, ret,
N_("Failed to encode DigestREQest", ""));
goto out;
}
if (size != data.length)
krb5_abortx(context, "ASN.1 internal encoder error");
ret = krb5_sendto_kdc(context, &data, &r, &data2);
if (ret)
goto out;
ret = decode_DigestREP(data2.data, data2.length, &rep, NULL);
if (ret) {
krb5_set_error_message(context, ret,
N_("Failed to parse digest response", ""));
goto out;
}
{
krb5_ap_rep_enc_part *repl;
ret = krb5_rd_rep(context, ac, &rep.apRep, &repl);
if (ret)
goto out;
krb5_free_ap_rep_enc_part(context, repl);
}
{
krb5_keyblock *key;
ret = krb5_auth_con_getremotesubkey(context, ac, &key);
if (ret)
goto out;
if (key == NULL) {
ret = EINVAL;
krb5_set_error_message(context, ret,
N_("Digest reply have no remote subkey", ""));
goto out;
}
krb5_crypto_destroy(context, crypto);
ret = krb5_crypto_init(context, key, 0, &crypto);
krb5_free_keyblock (context, key);
if (ret)
goto out;
}
krb5_data_free(&data);
ret = krb5_decrypt_EncryptedData(context, crypto, usage,
&rep.innerRep, &data);
if (ret)
goto out;
ret = decode_DigestRepInner(data.data, data.length, irep, NULL);
if (ret) {
krb5_set_error_message(context, ret,
N_("Failed to decode digest inner reply", ""));
goto out;
}
out:
if (ccache == NULL && id)
krb5_cc_close(context, id);
if (realm == NULL && r)
free(r);
if (crypto)
krb5_crypto_destroy(context, crypto);
if (ac)
krb5_auth_con_free(context, ac);
if (principal)
krb5_free_principal(context, principal);
krb5_data_free(&data);
krb5_data_free(&data2);
free_DigestREQ(&req);
free_DigestREP(&rep);
return ret;
}
