Move to using more of native Heimdal API

Complete except for reauth code. This is useful for platforms
such as OS X that do not export the MIT compatibility API.

diff --git a/mech_eap/pseudo_random.c b/mech_eap/pseudo_random.c
index ad079b4..2d3fcfd 100644 (file)
--- a/mech_eap/pseudo_random.c
+++ b/mech_eap/pseudo_random.c
@@ -74,6 +74,9 @@ gssEapPseudoRandom(OM_uint32 *minor,
     unsigned char *p;
     krb5_context krbContext;
     ssize_t desired_output_len = prf_out->length;
+#ifdef HAVE_HEIMDAL_VERSION
+    krb5_crypto krbCrypto = NULL;
+#endif
 
     *minor = 0;
 
@@ -88,9 +91,11 @@ gssEapPseudoRandom(OM_uint32 *minor,
         goto cleanup;
     }
 
-    code = krb5_c_prf_length(krbContext,
-                             ctx->encryptionType,
-                             &prflen);
+#ifdef HAVE_HEIMDAL_VERSION
+    code = krb5_crypto_prf_length(krbContext, ctx->encryptionType, &prflen);
+#else
+    code = krb5_c_prf_length(krbContext, ctx->encryptionType, &prflen);
+#endif
     if (code != 0)
         goto cleanup;
 
@@ -101,8 +106,11 @@ gssEapPseudoRandom(OM_uint32 *minor,
         goto cleanup;
     }
 
-#ifndef HAVE_HEIMDAL_VERSION
-    /* Same API, but different allocation rules, unfortunately. */
+#ifdef HAVE_HEIMDAL_VERSION
+    code = krb5_crypto_init(krbContext, &ctx->rfc3961Key, 0, &krbCrypto);
+    if (code != 0)
+        goto cleanup;
+#else
     t.length = prflen;
     t.data = GSSEAP_MALLOC(t.length);
     if (t.data == NULL) {
@@ -117,7 +125,11 @@ gssEapPseudoRandom(OM_uint32 *minor,
     while (desired_output_len > 0) {
         store_uint32_be(i, ns.data);
 
+#ifdef HAVE_HEIMDAL_VERSION
+        code = krb5_crypto_prf(krbContext, krbCrypto, &ns, &t);
+#else
         code = krb5_c_prf(krbContext, &ctx->rfc3961Key, &ns, &t);
+#endif
         if (code != 0)
             goto cleanup;
 
@@ -136,6 +148,7 @@ cleanup:
         GSSEAP_FREE(ns.data);
     }
 #ifdef HAVE_HEIMDAL_VERSION
+    krb5_crypto_destroy(krbContext, krbCrypto);
     krb5_data_free(&t);
 #else
     if (t.data != NULL) {

diff --git a/mech_eap/util_krb.c b/mech_eap/util_krb.c
index 78064f3..9b9692a 100644 (file)
--- a/mech_eap/util_krb.c
+++ b/mech_eap/util_krb.c
@@ -68,7 +68,11 @@ initKrbContext(krb5_context *pKrbContext)
     *pKrbContext = krbContext;
 
 cleanup:
+#ifdef HAVE_HEIMDAL_VERSION
+    krb5_xfree(defaultRealm);
+#else
     krb5_free_default_realm(krbContext, defaultRealm);
+#endif
 
     if (code != 0 && krbContext != NULL)
         krb5_free_context(krbContext);
@@ -121,7 +125,9 @@ gssEapDeriveRfc3961Key(OM_uint32 *minor,
                        krb5_keyblock *pKey)
 {
     krb5_context krbContext;
-#ifndef HAVE_HEIMDAL_VERSION
+#ifdef HAVE_HEIMDAL_VERSION
+    krb5_crypto krbCrypto = NULL;
+#else
     krb5_data data;
 #endif
     krb5_data ns, t, derivedKeyData;
@@ -142,12 +148,24 @@ gssEapDeriveRfc3961Key(OM_uint32 *minor,
     KRB_DATA_INIT(&t);
     KRB_DATA_INIT(&derivedKeyData);
 
+#ifdef HAVE_HEIMDAL_VERSION
+    code = krb5_enctype_keybits(krbContext, encryptionType, &randomLength);
+    if (code != 0)
+        goto cleanup;
+
+    randomLength = (randomLength + 7) / 8; /* from mit_glue.c */
+
+    code = krb5_enctype_keysize(krbContext, encryptionType, &keyLength);
+    if (code != 0)
+        goto cleanup;
+#else
     code = krb5_c_keylengths(krbContext, encryptionType,
                              &randomLength, &keyLength);
     if (code != 0)
         goto cleanup;
+#endif /* HAVE_HEIMDAL_VERSION */
 
-    /* Convert EAP MSK into a Kerberos key */
+    /* Convert BrowserID DH key into a Kerberos key */
 
 #ifdef HAVE_HEIMDAL_VERSION
     code = krb5_random_to_key(krbContext, encryptionType, inputKey,
@@ -175,12 +193,19 @@ gssEapDeriveRfc3961Key(OM_uint32 *minor,
     ns.data = (char *)constant;
 
     /* Plug derivation constant and key into PRF */
+#ifdef HAVE_HEIMDAL_VERSION
+    code = krb5_crypto_prf_length(krbContext, encryptionType, &prfLength);
+#else
     code = krb5_c_prf_length(krbContext, encryptionType, &prfLength);
+#endif
     if (code != 0)
         goto cleanup;
 
-#ifndef HAVE_HEIMDAL_VERSION
-    /* Same API, but different allocation rules, unfortunately. */
+#ifdef HAVE_HEIMDAL_VERSION
+    code = krb5_crypto_init(krbContext, &kd, 0, &krbCrypto);
+    if (code != 0)
+        goto cleanup;
+#else
     t.length = prfLength;
     t.data = GSSEAP_MALLOC(t.length);
     if (t.data == NULL) {
@@ -202,7 +227,11 @@ gssEapDeriveRfc3961Key(OM_uint32 *minor,
     {
         store_uint32_be(i, ns.data);
 
+#ifdef HAVE_HEIMDAL_VERSION
+        code = krb5_crypto_prf(krbContext, krbCrypto, &ns, &t);
+#else
         code = krb5_c_prf(krbContext, &kd, &ns, &t);
+#endif
         if (code != 0)
             goto cleanup;
 
@@ -229,6 +258,7 @@ cleanup:
     if (code != 0)
         krb5_free_keyblock_contents(krbContext, &kd);
 #ifdef HAVE_HEIMDAL_VERSION
+    krb5_crypto_destroy(krbContext, krbCrypto);
     krb5_data_free(&t);
 #else
     if (t.data != NULL) {
@@ -257,10 +287,13 @@ rfc3961ChecksumTypeForKey(OM_uint32 *minor,
                           krb5_cksumtype *cksumtype)
 {
     krb5_context krbContext;
-#ifndef HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE
+#if !defined(HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE) && !defined(HAVE_HEIMDAL_VERSION)
     krb5_data data;
     krb5_checksum cksum;
 #endif
+#ifdef HAVE_HEIMDAL_VERSION
+    krb5_crypto krbCrypto = NULL;
+#endif
 
     GSSEAP_KRB_INIT(&krbContext);
 
@@ -269,6 +302,17 @@ rfc3961ChecksumTypeForKey(OM_uint32 *minor,
                                            cksumtype);
     if (*minor != 0)
         return GSS_S_FAILURE;
+#elif defined(HAVE_HEIMDAL_VERSION)
+    *minor = krb5_crypto_init(krbContext, key, 0, &krbCrypto);
+    if (*minor != 0)
+        return GSS_S_FAILURE;
+
+    *minor = krb5_crypto_get_checksum_type(krbContext, krbCrypto, cksumtype);
+
+    krb5_crypto_destroy(krbContext, krbCrypto);
+
+    if (*minor != 0)
+        return GSS_S_FAILURE;
 #else
     KRB_DATA_INIT(&data);
 
@@ -288,7 +332,12 @@ rfc3961ChecksumTypeForKey(OM_uint32 *minor,
     krb5_free_checksum_contents(krbContext, &cksum);
 #endif /* HAVE_KRB5INT_C_MANDATORY_CKSUMTYPE */
 
-    if (!krb5_c_is_keyed_cksum(*cksumtype)) {
+#ifdef HAVE_HEIMDAL_VERSION
+    if (!krb5_checksum_is_keyed(krbContext, *cksumtype))
+#else
+    if (!krb5_c_is_keyed_cksum(*cksumtype))
+#endif
+    {
         *minor = (OM_uint32)KRB5KRB_AP_ERR_INAPP_CKSUM;
         return GSS_S_FAILURE;
     }

diff --git a/mech_eap/util_mech.c b/mech_eap/util_mech.c
index 8cb7e74..944a2fa 100644 (file)
--- a/mech_eap/util_mech.c
+++ b/mech_eap/util_mech.c
@@ -196,7 +196,11 @@ gssEapIndicateMechs(OM_uint32 *minor,
 
     GSSEAP_KRB_INIT(&krbContext);
 
+#ifdef HAVE_HEIMDAL_VERSION
+    *minor = krb5_get_default_in_tkt_etypes(krbContext, KRB5_PDU_NONE, &etypes);
+#else
     *minor = krb5_get_permitted_enctypes(krbContext, &etypes);
+#endif
     if (*minor != 0) {
         return GSS_S_FAILURE;
     }

diff --git a/mech_eap/util_name.c b/mech_eap/util_name.c
index 455e764..8386349 100644 (file)
--- a/mech_eap/util_name.c
+++ b/mech_eap/util_name.c
@@ -270,10 +270,11 @@ importEapNameFlags(OM_uint32 *minor,
             if (KRB_PRINC_REALM(krbPrinc) == NULL)
                 code = ENOMEM;
         }
-#endif
-
+        krb5_xfree(defaultRealm);
+#else
         if (defaultRealm != NULL)
             krb5_free_default_realm(krbContext, defaultRealm);
+#endif
     }
 
     if (nameBuffer != GSS_C_NO_BUFFER)