comment out dumping code

[moonshot.git] / mech_eap / util_krb.c

diff --git a/mech_eap/util_krb.c b/mech_eap/util_krb.c
index 7143685..abc9e61 100644 (file)
--- a/mech_eap/util_krb.c
+++ b/mech_eap/util_krb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, JANET(UK)
+ * Copyright (c) 2011, JANET(UK)
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -54,6 +54,40 @@ createKrbContextKey(void)
     GSSEAP_KEY_CREATE(&krbContextKey, destroyKrbContext);
 }
 
+static krb5_error_code
+initKrbContext(krb5_context *pKrbContext)
+{
+    krb5_context krbContext;
+    krb5_error_code code;
+    char *defaultRealm = NULL;
+
+    *pKrbContext = NULL;
+
+    code = krb5_init_context(&krbContext);
+    if (code != 0)
+        goto cleanup;
+
+    krb5_appdefault_string(krbContext, "eap_gss",
+                           NULL, "default_realm", "", &defaultRealm);
+
+    if (defaultRealm != NULL && defaultRealm[0] != '\0') {
+        code = krb5_set_default_realm(krbContext, defaultRealm);
+        if (code != 0)
+            goto cleanup;
+    }
+
+    *pKrbContext = krbContext;
+
+cleanup:
+    if (code != 0 && krbContext != NULL)
+        krb5_free_context(krbContext);
+
+    if (defaultRealm != NULL)
+        GSSEAP_FREE(defaultRealm);
+
+    return code;
+}
+
 OM_uint32
 gssEapKerberosInit(OM_uint32 *minor, krb5_context *context)
 {
@@ -63,7 +97,7 @@ gssEapKerberosInit(OM_uint32 *minor, krb5_context *context)
 
     *context = GSSEAP_GETSPECIFIC(krbContextKey);
     if (*context == NULL) {
-        *minor = krb5_init_context(context);
+        *minor = initKrbContext(context);
         if (*minor == 0) {
             if (GSSEAP_SETSPECIFIC(krbContextKey, *context) != 0) {
                 *minor = errno;
@@ -370,7 +404,12 @@ krbBlockSize(krb5_context krbContext,
 }
 
 krb5_error_code
-krbEnctypeToString(krb5_context krbContext,
+krbEnctypeToString(
+#ifdef HAVE_HEIMDAL_VERSION
+                   krb5_context krbContext,
+#else
+                   krb5_context krbContext GSSEAP_UNUSED,
+#endif
                    krb5_enctype enctype,
                    const char *prefix,
                    gss_buffer_t string)
@@ -496,9 +535,11 @@ krbMakeCred(krb5_context krbContext,
 #ifdef HAVE_HEIMDAL_VERSION
     KRB_CRED krbCred;
     KrbCredInfo krbCredInfo;
+    EncKrbCredPart encKrbCredPart;
     krb5_keyblock *key;
     krb5_crypto krbCrypto = NULL;
-    krb5_data credInfoData = { 0 };
+    krb5_data encKrbCredPartData;
+    krb5_replay_data rdata;
     size_t len;
 #else
     krb5_data *d = NULL;
@@ -506,12 +547,17 @@ krbMakeCred(krb5_context krbContext,
 
     memset(data, 0, sizeof(*data));
 #ifdef HAVE_HEIMDAL_VERSION
-    memset(&krbCred, 0, sizeof(krbCred));
-    memset(&krbCredInfo, 0, sizeof(krbCredInfo));
-
-    key = (authContext->local_subkey != NULL)
-          ? authContext->local_subkey
-          : authContext->keyblock;
+    memset(&krbCred,        0, sizeof(krbCred));
+    memset(&krbCredInfo,    0, sizeof(krbCredInfo));
+    memset(&encKrbCredPart, 0, sizeof(encKrbCredPart));
+    memset(&rdata,          0, sizeof(rdata));
+
+    if (authContext->local_subkey)
+        key = authContext->local_subkey;
+    else if (authContext->remote_subkey)
+        key = authContext->remote_subkey;
+    else
+        key = authContext->keyblock;
 
     krbCred.pvno = 5;
     krbCred.msg_type = krb_cred;
@@ -540,8 +586,28 @@ krbMakeCred(krb5_context krbContext,
     krbCredInfo.sname       = &creds->server->name;
     krbCredInfo.caddr       = creds->addresses.len ? &creds->addresses : NULL;
 
-    ASN1_MALLOC_ENCODE(KrbCredInfo, credInfoData.data, credInfoData.length,
-                       &krbCredInfo, &len, code);
+    encKrbCredPart.ticket_info.len = 1;
+    encKrbCredPart.ticket_info.val = &krbCredInfo;
+    if (authContext->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) {
+        rdata.seq                  = authContext->local_seqnumber;
+        encKrbCredPart.nonce       = (int32_t *)&rdata.seq;
+    } else {
+        encKrbCredPart.nonce       = NULL;
+    }
+    if (authContext->flags & KRB5_AUTH_CONTEXT_DO_TIME) {
+        krb5_us_timeofday(krbContext, &rdata.timestamp, &rdata.usec);
+        encKrbCredPart.timestamp   = &rdata.timestamp;
+        encKrbCredPart.usec        = &rdata.usec;
+    } else {
+        encKrbCredPart.timestamp   = NULL;
+        encKrbCredPart.usec        = NULL;
+    }
+    encKrbCredPart.s_address       = authContext->local_address;
+    encKrbCredPart.r_address       = authContext->remote_address;
+
+    ASN1_MALLOC_ENCODE(EncKrbCredPart, encKrbCredPartData.data,
+                       encKrbCredPartData.length, &encKrbCredPart,
+                       &len, code);
     if (code != 0)
         goto cleanup;
 
@@ -552,8 +618,8 @@ krbMakeCred(krb5_context krbContext,
     code = krb5_encrypt_EncryptedData(krbContext,
                                       krbCrypto,
                                       KRB5_KU_KRB_CRED,
-                                      credInfoData.data,
-                                      credInfoData.length,
+                                      encKrbCredPartData.data,
+                                      encKrbCredPartData.length,
                                       0,
                                       &krbCred.enc_part);
     if (code != 0)
@@ -564,11 +630,14 @@ krbMakeCred(krb5_context krbContext,
     if (code != 0)
         goto cleanup;
 
+    if (authContext->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE)
+        authContext->local_seqnumber++;
+
 cleanup:
     if (krbCrypto != NULL)
         krb5_crypto_destroy(krbContext, krbCrypto);
     free_KRB_CRED(&krbCred);
-    krb5_data_free(&credInfoData);
+    krb5_data_free(&encKrbCredPartData);
 
     return code;
 #else