Use krb5_c_make_checksum hack to determine checksum

type without using private API

diff --git a/mech_eap/accept_sec_context.c b/mech_eap/accept_sec_context.c
index 9de9821..7aea19d 100644 (file)
--- a/mech_eap/accept_sec_context.c
+++ b/mech_eap/accept_sec_context.c
@@ -32,6 +32,9 @@
 
 #include "gssapiP_eap.h"
 
+#define BUILTIN_EAP
+
+#ifdef BUILTIN_EAP
 #define EAP_MAX_METHODS 8
 
 #define EAP_TTLS_AUTH_PAP 1
@@ -39,7 +42,6 @@
 #define EAP_TTLS_AUTH_MSCHAP 4
 #define EAP_TTLS_AUTH_MSCHAPV2 8
 
-#if 1
 struct eap_user {
         struct {
                 int vendor;
@@ -213,7 +215,7 @@ serverGetEapReqIdText(void *ctx,
     *len = 0;
     return NULL;
 }
-#endif
+#endif /* BUILTIN_EAP */
 
 static OM_uint32
 acceptReady(OM_uint32 *minor, gss_ctx_id_t ctx)
@@ -227,11 +229,6 @@ acceptReady(OM_uint32 *minor, gss_ctx_id_t ctx)
 
     if (ctx->encryptionType != ENCTYPE_NULL &&
         ctx->acceptorCtx.eapPolInterface->eapKeyAvailable) {
-        major = rfc3961EncTypeToChecksumType(minor, ctx->encryptionType,
-                                             &ctx->checksumType);
-        if (GSS_ERROR(major))
-            return major;
-
         major = gssEapDeriveRfc3961Key(minor,
                                        ctx->acceptorCtx.eapPolInterface->eapKeyData,
                                        ctx->acceptorCtx.eapPolInterface->eapKeyDataLen,
@@ -239,6 +236,11 @@ acceptReady(OM_uint32 *minor, gss_ctx_id_t ctx)
                                        &ctx->rfc3961Key);
         if (GSS_ERROR(major))
             return major;
+
+        major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key,
+                                           &ctx->checksumType);
+        if (GSS_ERROR(major))
+            return major;
     } else {
         /*
          * draft-howlett-eap-gss says that integrity/confidentialty should

diff --git a/mech_eap/gssapiP_eap.h b/mech_eap/gssapiP_eap.h
index 54b68d4..3a2dd80 100644 (file)
--- a/mech_eap/gssapiP_eap.h
+++ b/mech_eap/gssapiP_eap.h
@@ -180,5 +180,4 @@ gssEapUnwrapOrVerifyMIC(OM_uint32 *minor_status,
                         int iov_count,
                         enum gss_eap_token_type toktype);
 
-
 #endif /* _GSSAPIP_EAP_H_ */

diff --git a/mech_eap/init_sec_context.c b/mech_eap/init_sec_context.c
index a54a3cb..27d7c06 100644 (file)
--- a/mech_eap/init_sec_context.c
+++ b/mech_eap/init_sec_context.c
@@ -248,13 +248,13 @@ initReady(OM_uint32 *minor, gss_ctx_id_t ctx)
         eap_key_available(ctx->initiatorCtx.eap)) {
         key = eap_get_eapKeyData(ctx->initiatorCtx.eap, &keyLength);
 
-        major = rfc3961EncTypeToChecksumType(minor, ctx->encryptionType,
-                                             &ctx->checksumType);
+        major = gssEapDeriveRfc3961Key(minor, key, keyLength,
+                                       ctx->encryptionType, &ctx->rfc3961Key);
         if (GSS_ERROR(major))
             return major;
 
-        major = gssEapDeriveRfc3961Key(minor, key, keyLength,
-                                       ctx->encryptionType, &ctx->rfc3961Key);
+        major = rfc3961ChecksumTypeForKey(minor, &ctx->rfc3961Key,
+                                           &ctx->checksumType);
         if (GSS_ERROR(major))
             return major;
     } else {

diff --git a/mech_eap/util.h b/mech_eap/util.h
index 9933615..ea0d820 100644 (file)
--- a/mech_eap/util.h
+++ b/mech_eap/util.h
@@ -209,9 +209,9 @@ OM_uint32
 gssEapKerberosInit(OM_uint32 *minor, krb5_context *context);
 
 OM_uint32
-rfc3961EncTypeToChecksumType(OM_uint32 *minor,
-                             krb5_enctype etype,
-                             krb5_cksumtype *cksumtype);
+rfc3961ChecksumTypeForKey(OM_uint32 *minor,
+                          krb5_keyblock *key,
+                          krb5_cksumtype *cksumtype);
 
 #define GSSEAP_KRB_INIT(ctx) do {                   \
         OM_uint32 tmpMajor;                         \

diff --git a/mech_eap/util_krb.c b/mech_eap/util_krb.c
index 2836e1a..ccce938 100644 (file)
--- a/mech_eap/util_krb.c
+++ b/mech_eap/util_krb.c
@@ -172,21 +172,43 @@ cleanup:
     return (code == 0) ? GSS_S_COMPLETE : GSS_S_FAILURE;
 }
 
+#ifdef HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE
 extern krb5_error_code
 krb5int_c_mandatory_cksumtype(krb5_context, krb5_enctype, krb5_cksumtype *);
+#endif
 
 OM_uint32
-rfc3961EncTypeToChecksumType(OM_uint32 *minor,
-                             krb5_enctype etype,
-                             krb5_cksumtype *cksumtype)
+rfc3961ChecksumTypeForKey(OM_uint32 *minor,
+                          krb5_keyblock *key,
+                          krb5_cksumtype *cksumtype)
 {
     krb5_context krbContext;
+#ifndef HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE
+    krb5_data data;
+    krb5_checksum cksum;
+#endif
 
     GSSEAP_KRB_INIT(&krbContext);
 
-    *minor = krb5int_c_mandatory_cksumtype(krbContext, etype, cksumtype);
+#ifdef HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE
+    *minor = krb5int_c_mandatory_cksumtype(krbContext, KRB_KEY_TYPE(key),
+                                           cksumtype);
     if (*minor != 0)
         return GSS_S_FAILURE;
+#else
+    data.length = 0;
+    data.data = NULL;
+
+    memset(&cksum, 0, sizeof(cksum));
+
+    *minor = krb5_c_make_checksum(krbContext, 0, key, 0, &data, &cksum);
+    if (*minor != 0)
+        return GSS_S_FAILURE;
+
+    *cksumtype = cksum.checksum_type;
+
+    krb5_free_checksum_contents(krbContext, &cksum);
+#endif /* HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE */
 
     return GSS_S_COMPLETE;
 }