Commit 8de83bf8 authored by Richard Levitte's avatar Richard Levitte
Browse files

Changes to the Kerberos SSL code by Jeffrey Altman <jaltman@columbia.edu> 

His comments are:

 . Fixed all of the Windows dynamic loading functions, prototypes, etc.

 . Corrected all of the unsigned/signed comparison warnings

 . Replaced the references to krb5_cksumarray[] for two reasons.
   First, it was an internal variable that should not have been
   referenced outside the library; nor could it have been with
   a shared library with restricted exports.  Second, the
   variable is no longer used in current Kerberos implementations.
   I replaced the code with equivalent functionality using functions
   that are exported from the library.
parent 679df234

ssl/kssl.c

+123 −54
Original line number Diff line number Diff line
@@ -120,9 +120,12 @@ 
#define krb5_decrypt_tkt_part    kssl_krb5_decrypt_tkt_part

#define krb5_timeofday           kssl_krb5_timeofday

#define krb5_rc_default           kssl_krb5_rc_default

#define krb5_krb5_rc_initialize   kssl_krb5_rc_initialize

#define krb5_krb5_rc_get_lifespan kssl_krb5_rc_get_lifespan

#define krb5_krb5_rc_destroy      kssl_krb5_rc_destroy

#define krb5_rc_initialize   kssl_krb5_rc_initialize

#define krb5_rc_get_lifespan kssl_krb5_rc_get_lifespan

#define krb5_rc_destroy      kssl_krb5_rc_destroy

#define valid_cksumtype      kssl_valid_cksumtype

#define krb5_checksum_size   kssl_krb5_checksum_size

#define krb5_kt_free_entry   kssl_krb5_kt_free_entry



/* Prototypes for built in stubs */

void kssl_krb5_free_data_contents(krb5_context, krb5_data *);
@@ -140,16 +143,6 @@ krb5_error_code kssl_krb5_rd_req(krb5_context, krb5_auth_context *, 


krb5_boolean kssl_krb5_principal_compare(krb5_context, krb5_const_principal,

                                         krb5_const_principal);

krb5_error_code krb5_decrypt_tkt_part(krb5_context, krb5_const krb5_keyblock *,

				      krb5_ticket *);

krb5_error_code krb5_timeofday(krb5_context context, krb5_int32 *timeret);

krb5_error_code krb5_rc_default(krb5_context context, krb5_rcache *rc);

krb5_error_code krb5_rc_initialize(krb5_context context, krb5_rcache rc,

				     krb5_deltat lifespan);

krb5_error_code krb5_rc_get_lifespan(krb5_context context, krb5_rcache rc,

				     krb5_deltat *lifespan);

krb5_error_code krb5_rc_destroy(krb5_context context, krb5_rcache rc);



krb5_error_code kssl_krb5_mk_req_extended(krb5_context,

                                          krb5_auth_context  *,

                                          krb5_const krb5_flags,
@@ -175,6 +168,9 @@ krb5_error_code kssl_krb5_cc_get_principal(krb5_context context, 
                                           krb5_ccache cache,

                                           krb5_principal *principal);

krb5_error_code kssl_krb5_auth_con_free(krb5_context,krb5_auth_context);

size_t kssl_krb5_checksum_size(krb5_context context,krb5_cksumtype ctype);

krb5_boolean kssl_valid_cksumtype(krb5_cksumtype ctype);

krb5_error_code krb5_kt_free_entry(krb5_context,krb5_keytab_entry FAR * );



/* Function pointers (almost all Kerberos functions are _stdcall) */

static void (_stdcall *p_krb5_free_data_contents)(krb5_context, krb5_data *)
@@ -214,6 +210,27 @@ static krb5_error_code (_stdcall *p_krb5_cc_get_principal) 
			 krb5_principal *principal)=NULL;

static krb5_error_code (_stdcall *p_krb5_auth_con_free)

			(krb5_context, krb5_auth_context)=NULL;

static krb5_error_code (_stdcall *p_krb5_decrypt_tkt_part)

                        (krb5_context, krb5_const krb5_keyblock *,

                                           krb5_ticket *)=NULL;

static krb5_error_code (_stdcall *p_krb5_timeofday)

                        (krb5_context context, krb5_int32 *timeret)=NULL;

static krb5_error_code (_stdcall *p_krb5_rc_default)

                        (krb5_context context, krb5_rcache *rc)=NULL;

static krb5_error_code (_stdcall *p_krb5_rc_initialize)

                        (krb5_context context, krb5_rcache rc,

                                     krb5_deltat lifespan)=NULL;

static krb5_error_code (_stdcall *p_krb5_rc_get_lifespan)

                        (krb5_context context, krb5_rcache rc,

                                       krb5_deltat *lifespan)=NULL;

static krb5_error_code (_stdcall *p_krb5_rc_destroy)

                        (krb5_context context, krb5_rcache rc)=NULL;

static krb5_boolean (_stdcall *p_krb5_principal_compare)

                     (krb5_context, krb5_const_principal, krb5_const_principal)=NULL;

static size_t (_stdcall *p_krb5_checksum_size)(krb5_context context,krb5_cksumtype ctype)=NULL;

static krb5_boolean (_stdcall *p_valid_cksumtype)(krb5_cksumtype ctype)=NULL;

static krb5_error_code (_stdcall *p_krb5_kt_free_entry)

                        (krb5_context,krb5_keytab_entry * )=NULL;

static int krb5_loaded = 0;     /* only attempt to initialize func ptrs once */



/* Function to Load the Kerberos 5 DLL and initialize function pointers */
@@ -271,6 +288,12 @@ load_krb5_dll(void) 
		GetProcAddress( hKRB5_32, "krb5_kt_resolve" );

	(FARPROC) p_krb5_auth_con_init =

		GetProcAddress( hKRB5_32, "krb5_auth_con_init" );

        (FARPROC) p_valid_cksumtype =

                GetProcAddress( hKRB5_32, "valid_cksumtype" );

        (FARPROC) p_krb5_checksum_size =

                GetProcAddress( hKRB5_32, "krb5_checksum_size" );

        (FARPROC) p_krb5_kt_free_entry =

                GetProcAddress( hKRB5_32, "krb5_kt_free_entry" );

	}



/* Stubs for each function to be dynamicly loaded */
@@ -463,7 +486,7 @@ krb5_principal_compare(krb5_context con, krb5_const_principal princ1, 
		load_krb5_dll();



	if ( p_krb5_principal_compare )

		return(p_krb5_principal_compare(con,princ1,princ2);

		return(p_krb5_principal_compare(con,princ1,princ2));

	else

		return KRB5KRB_ERR_GENERIC;

	}
@@ -476,7 +499,7 @@ krb5_decrypt_tkt_part(krb5_context con, krb5_const krb5_keyblock *keys, 
		load_krb5_dll();



	if ( p_krb5_decrypt_tkt_part )

		return(p_krb5_decrypt_tkt_part(con,keys,ticket);

		return(p_krb5_decrypt_tkt_part(con,keys,ticket));

	else

		return KRB5KRB_ERR_GENERIC;

	}
@@ -488,7 +511,7 @@ krb5_timeofday(krb5_context con, krb5_int32 *timeret) 
		load_krb5_dll();



	if ( p_krb5_timeofday )

		return(p_krb5_timeofday(con,timeret);

		return(p_krb5_timeofday(con,timeret));

	else

		return KRB5KRB_ERR_GENERIC;

	}
@@ -500,7 +523,7 @@ krb5_rc_default(krb5_context con, krb5_rcache *rc) 
		load_krb5_dll();



	if ( p_krb5_rc_default )

		return(p_krb5_rc_default(con,rc);

		return(p_krb5_rc_default(con,rc));

	else

		return KRB5KRB_ERR_GENERIC;

	}
@@ -512,7 +535,7 @@ krb5_rc_initialize(krb5_context con, krb5_rcache rc, krb5_deltat lifespan) 
		load_krb5_dll();



	if ( p_krb5_rc_initialize )

		return(p_krb5_rc_initialize(con, rc, lifespan);

		return(p_krb5_rc_initialize(con, rc, lifespan));

	else

		return KRB5KRB_ERR_GENERIC;

	}
@@ -524,7 +547,7 @@ krb5_rc_get_lifespan(krb5_context con, krb5_rcache rc, krb5_deltat *lifespanp) 
		load_krb5_dll();



	if ( p_krb5_rc_get_lifespan )

		return(p_krb5_rc_get_lifespan(con, rc, lifespanp);

		return(p_krb5_rc_get_lifespan(con, rc, lifespanp));

	else

		return KRB5KRB_ERR_GENERIC;

	}
@@ -536,7 +559,43 @@ krb5_rc_destroy(krb5_context con, krb5_rcache rc) 
		load_krb5_dll();



	if ( p_krb5_rc_destroy )

		return(p_krb5_rc_destroy(con, rc);

		return(p_krb5_rc_destroy(con, rc));

	else

		return KRB5KRB_ERR_GENERIC;

	}



size_t 

krb5_checksum_size(krb5_context context,krb5_cksumtype ctype)

        {

        if (!krb5_loaded)

                load_krb5_dll();



        if ( p_krb5_checksum_size )

                return(p_krb5_checksum_size(context, ctype));

        else

                return KRB5KRB_ERR_GENERIC;

        }



krb5_boolean 

valid_cksumtype(krb5_cksumtype ctype)

        {

        if (!krb5_loaded)

                load_krb5_dll();



        if ( p_valid_cksumtype )

                return(p_valid_cksumtype(ctype));

        else

                return KRB5KRB_ERR_GENERIC;

        }



krb5_error_code 

krb5_kt_free_entry(krb5_context con,krb5_keytab_entry * entry)

        {

        if (!krb5_loaded)

                load_krb5_dll();



        if ( p_krb5_kt_free_entry )

                return(p_krb5_kt_free_entry(con,entry));

        else

                return KRB5KRB_ERR_GENERIC;

        }
@@ -562,36 +621,36 @@ typedef struct _krb5_cc_ops 
	krb5_magic magic;

	char  *prefix;

	char  * (KRB5_CALLCONV *get_name)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache));

		(krb5_context, krb5_ccache);

	krb5_error_code (KRB5_CALLCONV *resolve)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache  *, const char  *));

		(krb5_context, krb5_ccache  *, const char  *);

	krb5_error_code (KRB5_CALLCONV *gen_new)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache  *));

		(krb5_context, krb5_ccache  *);

	krb5_error_code (KRB5_CALLCONV *init)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache, krb5_principal));

		(krb5_context, krb5_ccache, krb5_principal);

	krb5_error_code (KRB5_CALLCONV *destroy)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache));

		(krb5_context, krb5_ccache);

	krb5_error_code (KRB5_CALLCONV *close)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache));

		(krb5_context, krb5_ccache);

	krb5_error_code (KRB5_CALLCONV *store)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache, krb5_creds  *));

		(krb5_context, krb5_ccache, krb5_creds  *);

	krb5_error_code (KRB5_CALLCONV *retrieve)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache,

		krb5_flags, krb5_creds  *, krb5_creds  *));

		(krb5_context, krb5_ccache,

		krb5_flags, krb5_creds  *, krb5_creds  *);

	krb5_error_code (KRB5_CALLCONV *get_princ)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache, krb5_principal  *));

		(krb5_context, krb5_ccache, krb5_principal  *);

	krb5_error_code (KRB5_CALLCONV *get_first)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache, krb5_cc_cursor  *));

		(krb5_context, krb5_ccache, krb5_cc_cursor  *);

	krb5_error_code (KRB5_CALLCONV *get_next)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache,

		krb5_cc_cursor  *, krb5_creds  *));

		(krb5_context, krb5_ccache,

		krb5_cc_cursor  *, krb5_creds  *);

	krb5_error_code (KRB5_CALLCONV *end_get)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache, krb5_cc_cursor  *));

		(krb5_context, krb5_ccache, krb5_cc_cursor  *);

	krb5_error_code (KRB5_CALLCONV *remove_cred)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache,

		krb5_flags, krb5_creds  *));

		(krb5_context, krb5_ccache,

		krb5_flags, krb5_creds  *);

	krb5_error_code (KRB5_CALLCONV *set_flags)

		KRB5_NPROTOTYPE((krb5_context, krb5_ccache, krb5_flags));

		(krb5_context, krb5_ccache, krb5_flags);

	} krb5_cc_ops;

#endif /* NO_DEF_KRB5_CCACHE */
@@ -697,23 +756,29 @@ int kssl_test_confound(unsigned char *p) 
/*	Allocate, fill, and return cksumlens array of checksum lengths.

**	This array holds just the unique elements from the krb5_cksumarray[].

**	array[n] == 0 signals end of data.

**

**      The krb5_cksumarray[] was an internal variable that has since been

**      replaced by a more general method for storing the data.  It should

**      not be used.  Instead we use real API calls and make a guess for 

**      what the highest assigned CKSUMTYPE_ constant is.  As of 1.2.2

**      it is 0x000c (CKSUMTYPE_HMAC_SHA1_DES3).  So we will use 0x0010.

*/

int 	*populate_cksumlens(void)

	{

	int 		i, j, n = krb5_max_cksum+1;

	static int 	*cklens = NULL;

	int 		i, j, n = 0x0010+1;

	static size_t 	*cklens = NULL;



#ifdef KRB5CHECKAUTH

	if (!cklens && !(cklens = (int *) calloc(sizeof(int), n)))  return NULL;

	if (!cklens && !(cklens = (size_t *) calloc(sizeof(int), n)))  return NULL;



	for (i=0; i < krb5_max_cksum; i++)  {

		if (!krb5_cksumarray[i])  continue;	/*  array has holes  */

		for (j=0; j < krb5_max_cksum; j++)  {

	for (i=0; i < n; i++)  {

		if (!valid_cksumtype(i))  continue;	/*  array has holes  */

		for (j=0; j < n; j++)  {

			if (cklens[j] == 0)  {

				cklens[j] = krb5_cksumarray[i]->checksum_length;

				cklens[j] = krb5_checksum_size(NULL,i);

				break;		/*  krb5 elem was new: add   */

				}

			if (cklens[j] == krb5_cksumarray[i]->checksum_length)  {

			if (cklens[j] == krb5_checksum_size(NULL,i))  {

				break;		/*  ignore duplicate elements */

				}

			}
@@ -768,7 +833,7 @@ kssl_err_set(KSSL_ERR *kssl_err, int reason, char *text) 
void

print_krb5_data(char *label, krb5_data *kdata)

        {

	int 	i;

	unsigned int 	i;



	printf("%s[%d] ", label, kdata->length);

	for (i=0; i < kdata->length; i++)
@@ -813,7 +878,7 @@ print_krb5_authdata(char *label, krb5_authdata **adata) 
void

print_krb5_keyblock(char *label, krb5_keyblock *keyblk)

        {

	int 	i;

	unsigned int 	i;



	if (keyblk == NULL)

                {
@@ -845,17 +910,18 @@ print_krb5_keyblock(char *label, krb5_keyblock *keyblk) 
void

print_krb5_princ(char *label, krb5_principal_data *princ)

        {

	int 	i, j;

	unsigned int 	ui, uj;

        int i;



	printf("%s principal Realm: ", label);

	if (princ == NULL)  return;

	for (i=0; i < princ->realm.length; i++)  putchar(princ->realm.data[i]);

	for (ui=0; ui < princ->realm.length; ui++)  putchar(princ->realm.data[ui]);

	printf(" (nametype %d) has %d strings:\n", princ->type,princ->length);

	for (i=0; i < princ->length; i++)

                {

		printf("\t%d [%d]: ", i, princ->data[i].length);

		for (j=0; j < princ->data[i].length; j++)  {

			putchar(princ->data[i].data[j]);

		for (uj=0; uj < princ->data[i].length; uj++)  {

			putchar(princ->data[i].data[uj]);

			}

		printf("\n");

		}
@@ -996,7 +1062,8 @@ kssl_cget_tkt( /* UPDATE */ KSSL_CTX *kssl_ctx, 
			}



		if (ap_req)  KRB5_APREQ_free((KRB5_APREQ *) ap_req);

		if (krb5_app_req.length)  krb5_xfree(krb5_app_req.data);

		if (krb5_app_req.length)  

                        krb5_free_data_contents(krb5context,&krb5_app_req);

		}

#ifdef KRB5_HEIMDAL

	if (kssl_ctx_setkey(kssl_ctx, &krb5credsp->session))
@@ -1531,6 +1598,7 @@ kssl_ctx_show(KSSL_CTX *kssl_ctx) 
	return;

        }



#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_WIN32)

void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data)

	{

#ifdef KRB5_HEIMDAL
@@ -1545,7 +1613,7 @@ void kssl_krb5_free_data_contents(krb5_context context, krb5_data *data) 
	krb5_free_data_contents(NULL, data);

#endif

	}



#endif /* !OPENSSL_SYS_WINDOWS && !OPENSSL_SYS_WIN32 */



/*  Helper function for kssl_validate_times().

**  We need context->clockskew, but krb5_context is an opaque struct.
@@ -1631,6 +1699,7 @@ krb5_error_code kssl_check_authent( 
	int 			padl, outl, unencbufsize;

	struct tm		tm_time, *tm_l, *tm_g;

	time_t			now, tl, tg, tz_offset;

        char * strptime();



	*atimep = 0;

	kssl_err_set(kssl_err, 0, "");
@@ -1728,7 +1797,7 @@ krb5_error_code kssl_check_authent( 
		}

	else	strncpy(tbuf, auth->ctime->data, auth->ctime->length);

	

	if (strptime(tbuf, "%Y%m%d%H%M%S", &tm_time) != NULL)

	if ((char *)strptime(tbuf, "%Y%m%d%H%M%S", &tm_time) != NULL)

		{

		now  = time(&now);

		tm_l = localtime(&now); 	tl = mktime(tm_l);