diff options
Diffstat (limited to 'auth')
| -rw-r--r-- | auth/kerberos/gssapi_pac.c | 1 | ||||
| -rw-r--r-- | auth/kerberos/kerberos_pac.c | 37 | ||||
| -rw-r--r-- | auth/kerberos/pac_utils.h | 50 | ||||
| -rwxr-xr-x[-rw-r--r--] | auth/kerberos/wscript_build | 1 |
4 files changed, 78 insertions, 11 deletions
diff --git a/auth/kerberos/gssapi_pac.c b/auth/kerberos/gssapi_pac.c index 07c7c94205..05065b2725 100644 --- a/auth/kerberos/gssapi_pac.c +++ b/auth/kerberos/gssapi_pac.c @@ -22,6 +22,7 @@ #ifdef HAVE_KRB5 #include "libcli/auth/krb5_wrap.h" +#include "auth/kerberos/pac_utils.h" #if 0 /* FIXME - need proper configure/waf test diff --git a/auth/kerberos/kerberos_pac.c b/auth/kerberos/kerberos_pac.c index 5155c9fd28..eacf39d321 100644 --- a/auth/kerberos/kerberos_pac.c +++ b/auth/kerberos/kerberos_pac.c @@ -26,7 +26,7 @@ #ifdef HAVE_KRB5 #include "librpc/gen_ndr/ndr_krb5pac.h" -#include "libcli/auth/krb5_wrap.h" +#include "auth/kerberos/pac_utils.h" krb5_error_code check_pac_checksum(DATA_BLOB pac_data, struct PAC_SIGNATURE_DATA *sig, @@ -36,8 +36,18 @@ krb5_error_code check_pac_checksum(DATA_BLOB pac_data, krb5_error_code ret; krb5_checksum cksum; krb5_keyusage usage = 0; - - smb_krb5_checksum_from_pac_sig(&cksum, sig); + krb5_boolean checksum_valid = false; + krb5_data input; + +#ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM /* Heimdal */ + cksum.cksumtype = (krb5_cksumtype)sig->type; + cksum.checksum.length = sig->signature.length; + cksum.checksum.data = sig->signature.data; +#else /* MIT */ + cksum.checksum_type = (krb5_cksumtype)sig->type; + cksum.length = sig->signature.length; + cksum.contents = sig->signature.data; +#endif #ifdef HAVE_KRB5_KU_OTHER_CKSUM /* Heimdal */ usage = KRB5_KU_OTHER_CKSUM; @@ -47,14 +57,19 @@ krb5_error_code check_pac_checksum(DATA_BLOB pac_data, #error UNKNOWN_KRB5_KEYUSAGE #endif - ret = smb_krb5_verify_checksum(context, - keyblock, - usage, - &cksum, - pac_data.data, - pac_data.length); - - if (ret) { + input.data = (char *)pac_data.data; + input.length = pac_data.length; + + ret = krb5_c_verify_checksum(context, + keyblock, + usage, + &input, + &cksum, + &checksum_valid); + if (!checksum_valid) { + ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; + } + if (ret){ DEBUG(2,("check_pac_checksum: PAC Verification failed: %s (%d)\n", error_message(ret), ret)); return ret; diff --git a/auth/kerberos/pac_utils.h b/auth/kerberos/pac_utils.h new file mode 100644 index 0000000000..9fe08de834 --- /dev/null +++ b/auth/kerberos/pac_utils.h @@ -0,0 +1,50 @@ +/* + Unix SMB/CIFS implementation. + kerberos authorization data (PAC) utility library + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2011 + Copyright (C) Simo Sorce 2010-2012 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _PAC_UTILS_H +#define _PAC_UTILS_H + +#include "libcli/auth/krb5_wrap.h" +struct PAC_SIGNATURE_DATA; +struct PAC_DATA; + +krb5_error_code check_pac_checksum(DATA_BLOB pac_data, + struct PAC_SIGNATURE_DATA *sig, + krb5_context context, + const krb5_keyblock *keyblock); + +NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx, + DATA_BLOB pac_data_blob, + krb5_context context, + const krb5_keyblock *krbtgt_keyblock, + const krb5_keyblock *service_keyblock, + krb5_const_principal client_principal, + time_t tgs_authtime, + struct PAC_DATA **pac_data_out); + +NTSTATUS gssapi_obtain_pac_blob(TALLOC_CTX *mem_ctx, + gss_ctx_id_t gssapi_context, + gss_name_t gss_client_name, + DATA_BLOB *pac_data); +NTSTATUS gssapi_get_session_key(TALLOC_CTX *mem_ctx, + gss_ctx_id_t gssapi_context, + DATA_BLOB *session_key, + uint32_t *keytype); +#endif /* _PAC_UTILS_H */ diff --git a/auth/kerberos/wscript_build b/auth/kerberos/wscript_build index 2421b1654f..f49cc517ba 100644..100755 --- a/auth/kerberos/wscript_build +++ b/auth/kerberos/wscript_build @@ -1,3 +1,4 @@ +#!/usr/bin/env python bld.SAMBA_SUBSYSTEM('KRB5_PAC', source='gssapi_pac.c kerberos_pac.c', deps='gssapi_krb5 krb5 ndr-krb5pac com_err') |