From 7cabdeb7ec84c7c0b3e9b907e19f4e240b7fc4ca Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Tue, 29 Mar 2005 08:24:03 +0000 Subject: r6113: Move GENSEC and the kerberos code out of libcli/auth, and into auth/gensec and auth/kerberos. This also pulls the kerberos configure code out of libads (which is otherwise dead), and into auth/kerberos/kerberos.m4 Andrew Bartlett (This used to be commit e074d63f3dcf4f84239a10879112ebaf1cfa6c4f) --- source4/auth/kerberos/gssapi_parse.c | 95 ++++++++++++++++++++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 source4/auth/kerberos/gssapi_parse.c (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c new file mode 100644 index 0000000000..2c2c4e17e5 --- /dev/null +++ b/source4/auth/kerberos/gssapi_parse.c @@ -0,0 +1,95 @@ +/* + Unix SMB/CIFS implementation. + + simple GSSAPI wrappers + + Copyright (C) Andrew Tridgell 2001 + Copyright (C) Jim McDonough 2002 + Copyright (C) Luke Howard 2003 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "asn_1.h" +#include "system/kerberos.h" +#include "auth/gensec/gensec.h" + +/* + generate a krb5 GSS-API wrapper packet given a ticket +*/ +DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2]) +{ + struct asn1_data data; + DATA_BLOB ret = data_blob(NULL,0); + + if (!ticket->data) { + return ret; + } + + ZERO_STRUCT(data); + + asn1_push_tag(&data, ASN1_APPLICATION(0)); + asn1_write_OID(&data, GENSEC_OID_KERBEROS5); + + asn1_write(&data, tok_id, 2); + asn1_write(&data, ticket->data, ticket->length); + asn1_pop_tag(&data); + + if (data.has_error) { + DEBUG(1,("Failed to build krb5 wrapper at offset %d\n", (int)data.ofs)); + asn1_free(&data); + } + + ret = data_blob_talloc(mem_ctx, data.data, data.length); + asn1_free(&data); + + return ret; +} + +/* + parse a krb5 GSS-API wrapper packet giving a ticket +*/ +BOOL gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2]) +{ + BOOL ret; + struct asn1_data data; + int data_remaining; + + asn1_load(&data, *blob); + asn1_start_tag(&data, ASN1_APPLICATION(0)); + asn1_check_OID(&data, GENSEC_OID_KERBEROS5); + + data_remaining = asn1_tag_remaining(&data); + + if (data_remaining < 3) { + data.has_error = True; + } else { + asn1_read(&data, tok_id, 2); + data_remaining -= 2; + *ticket = data_blob_talloc(mem_ctx, NULL, data_remaining); + asn1_read(&data, ticket->data, ticket->length); + } + + asn1_end_tag(&data); + + ret = !data.has_error; + + asn1_free(&data); + + return ret; +} + + -- cgit From 8a68f96f8cea2c53c8babf2ec826dfc6ef1cc199 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Wed, 22 Jun 2005 02:12:26 +0000 Subject: r7827: Add in-memory keytab to Samba4, using the new MEMORY_WILDCARD keytab support in Heimdal. This removes the 'ext_keytab' step from my Samba4/WinXP client howto. In doing this work, I realised that the replay cache in Heimdal is currently a no-op, so I have removed the calls to it, and therefore the mutex calls from passdb/secrets.c. This patch also includes a replacement 'magic' mechanism detection, that does not issue extra error messages from deep inside the GSSAPI code. Andrew Bartlett (This used to be commit c19d5706f4fa760415b727b970bc99e7f1abd064) --- source4/auth/kerberos/gssapi_parse.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index 2c2c4e17e5..048eb8204e 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -93,3 +93,24 @@ BOOL gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, D } +/* + check a GSS-API wrapper packet givin an expected OID +*/ +BOOL gensec_gssapi_check_oid(const DATA_BLOB *blob, const char *oid) +{ + BOOL ret; + struct asn1_data data; + int data_remaining; + + asn1_load(&data, *blob); + asn1_start_tag(&data, ASN1_APPLICATION(0)); + asn1_check_OID(&data, GENSEC_OID_KERBEROS5); + + ret = !data.has_error; + + asn1_free(&data); + + return ret; +} + + -- cgit From 37e3d0262136a164596f80590466e943e54c8c1f Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Fri, 24 Jun 2005 01:13:57 +0000 Subject: r7863: removed an unused variable (This used to be commit 9ee3dbad6b0bc65f4f3ee64a52db765af8016738) --- source4/auth/kerberos/gssapi_parse.c | 1 - 1 file changed, 1 deletion(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index 048eb8204e..524eedc448 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -100,7 +100,6 @@ BOOL gensec_gssapi_check_oid(const DATA_BLOB *blob, const char *oid) { BOOL ret; struct asn1_data data; - int data_remaining; asn1_load(&data, *blob); asn1_start_tag(&data, ASN1_APPLICATION(0)); -- cgit From 906c142423dde9518a49eaa4819011d99216c711 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 30 Dec 2005 03:57:11 +0000 Subject: r12594: Jelmer pushed some proposed header reductions to the list today. This commits some of these that I know to be correct in the kerberos area. Andrew Bartlett (This used to be commit 6787b3737c27f5136152b007b0ee2ae314efac3c) --- source4/auth/kerberos/gssapi_parse.c | 1 - 1 file changed, 1 deletion(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index 524eedc448..a48179cc1a 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -24,7 +24,6 @@ #include "includes.h" #include "asn_1.h" -#include "system/kerberos.h" #include "auth/gensec/gensec.h" /* -- cgit From 78c50015bb8bd5a1d831a6e7ec796b3367c73145 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 3 Jan 2006 15:40:05 +0000 Subject: r12694: Move some headers to the directory of the subsystem they belong to. (This used to be commit c722f665c90103f3ed57621c460e32ad33e7a8a3) --- source4/auth/kerberos/gssapi_parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index a48179cc1a..5226d77a2b 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -23,7 +23,7 @@ */ #include "includes.h" -#include "asn_1.h" +#include "libcli/util/asn_1.h" #include "auth/gensec/gensec.h" /* -- cgit From b2d5ec03391dc649843700300f0b939f80c5a1ad Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 20 Dec 2006 12:49:11 +0000 Subject: r20274: add missing return statement and make it more explicit that we return a NULL DATA_BLOB metze (This used to be commit 7256481f08b5e860308e73c2b51926b55b1f4c43) --- source4/auth/kerberos/gssapi_parse.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index 5226d77a2b..7eefed7ac8 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -32,10 +32,10 @@ DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2]) { struct asn1_data data; - DATA_BLOB ret = data_blob(NULL,0); + DATA_BLOB ret; if (!ticket->data) { - return ret; + return data_blob(NULL,0); } ZERO_STRUCT(data); @@ -50,6 +50,7 @@ DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *tick if (data.has_error) { DEBUG(1,("Failed to build krb5 wrapper at offset %d\n", (int)data.ofs)); asn1_free(&data); + return data_blob(NULL,0); } ret = data_blob_talloc(mem_ctx, data.data, data.length); -- cgit From f09c0c1237762e96e2e2438973aa6c956d518ef0 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 20 Dec 2006 12:50:03 +0000 Subject: r20275: we should check for the oid the caller gave us! metze (This used to be commit 4b9e196288f2deb3594db9ba2dd36d774e774574) --- source4/auth/kerberos/gssapi_parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index 7eefed7ac8..cc9565a040 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -103,7 +103,7 @@ BOOL gensec_gssapi_check_oid(const DATA_BLOB *blob, const char *oid) asn1_load(&data, *blob); asn1_start_tag(&data, ASN1_APPLICATION(0)); - asn1_check_OID(&data, GENSEC_OID_KERBEROS5); + asn1_check_OID(&data, oid); ret = !data.has_error; -- cgit From 7bb939b1cb2b39a8271cf16d9f5fce5312a9af10 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Mon, 21 May 2007 06:12:06 +0000 Subject: r23030: finally fixed up our asn1 code to use better memory allocation. This should allow us to fix some long standing memory leaks. (This used to be commit 3db49c2ec9968221c1361785b94061046ecd159d) --- source4/auth/kerberos/gssapi_parse.c | 60 +++++++++++++++++------------------- 1 file changed, 29 insertions(+), 31 deletions(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index cc9565a040..86a9e9554a 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -31,30 +31,28 @@ */ DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2]) { - struct asn1_data data; + struct asn1_data *data = asn1_init(mem_ctx); DATA_BLOB ret; - if (!ticket->data) { + if (!data || !ticket->data) { return data_blob(NULL,0); } - ZERO_STRUCT(data); + asn1_push_tag(data, ASN1_APPLICATION(0)); + asn1_write_OID(data, GENSEC_OID_KERBEROS5); - asn1_push_tag(&data, ASN1_APPLICATION(0)); - asn1_write_OID(&data, GENSEC_OID_KERBEROS5); + asn1_write(data, tok_id, 2); + asn1_write(data, ticket->data, ticket->length); + asn1_pop_tag(data); - asn1_write(&data, tok_id, 2); - asn1_write(&data, ticket->data, ticket->length); - asn1_pop_tag(&data); - - if (data.has_error) { - DEBUG(1,("Failed to build krb5 wrapper at offset %d\n", (int)data.ofs)); - asn1_free(&data); + if (data->has_error) { + DEBUG(1,("Failed to build krb5 wrapper at offset %d\n", (int)data->ofs)); + asn1_free(data); return data_blob(NULL,0); } - ret = data_blob_talloc(mem_ctx, data.data, data.length); - asn1_free(&data); + ret = data_blob_talloc(mem_ctx, data->data, data->length); + asn1_free(data); return ret; } @@ -65,29 +63,29 @@ DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *tick BOOL gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2]) { BOOL ret; - struct asn1_data data; + struct asn1_data *data = asn1_init(mem_ctx); int data_remaining; - asn1_load(&data, *blob); - asn1_start_tag(&data, ASN1_APPLICATION(0)); - asn1_check_OID(&data, GENSEC_OID_KERBEROS5); + asn1_load(data, *blob); + asn1_start_tag(data, ASN1_APPLICATION(0)); + asn1_check_OID(data, GENSEC_OID_KERBEROS5); - data_remaining = asn1_tag_remaining(&data); + data_remaining = asn1_tag_remaining(data); if (data_remaining < 3) { - data.has_error = True; + data->has_error = True; } else { - asn1_read(&data, tok_id, 2); + asn1_read(data, tok_id, 2); data_remaining -= 2; *ticket = data_blob_talloc(mem_ctx, NULL, data_remaining); - asn1_read(&data, ticket->data, ticket->length); + asn1_read(data, ticket->data, ticket->length); } - asn1_end_tag(&data); + asn1_end_tag(data); - ret = !data.has_error; + ret = !data->has_error; - asn1_free(&data); + asn1_free(data); return ret; } @@ -99,15 +97,15 @@ BOOL gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, D BOOL gensec_gssapi_check_oid(const DATA_BLOB *blob, const char *oid) { BOOL ret; - struct asn1_data data; + struct asn1_data *data = asn1_init(NULL); - asn1_load(&data, *blob); - asn1_start_tag(&data, ASN1_APPLICATION(0)); - asn1_check_OID(&data, oid); + asn1_load(data, *blob); + asn1_start_tag(data, ASN1_APPLICATION(0)); + asn1_check_OID(data, oid); - ret = !data.has_error; + ret = !data->has_error; - asn1_free(&data); + asn1_free(data); return ret; } -- cgit From 931f594cf16b8c7f9f416d7a8831432b783a0ec8 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Mon, 21 May 2007 12:47:18 +0000 Subject: r23036: error checking on asn1_init() failure (This used to be commit 26cf8494084c0106ef0e1c9b6ef40eeadf945ef2) --- source4/auth/kerberos/gssapi_parse.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index 86a9e9554a..de6fa31afb 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -31,13 +31,18 @@ */ DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *ticket, const uint8_t tok_id[2]) { - struct asn1_data *data = asn1_init(mem_ctx); + struct asn1_data *data; DATA_BLOB ret; if (!data || !ticket->data) { return data_blob(NULL,0); } + data = asn1_init(mem_ctx); + if (data == NULL) { + return data_blob(NULL,0); + } + asn1_push_tag(data, ASN1_APPLICATION(0)); asn1_write_OID(data, GENSEC_OID_KERBEROS5); @@ -66,6 +71,10 @@ BOOL gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, D struct asn1_data *data = asn1_init(mem_ctx); int data_remaining; + if (!data) { + return False; + } + asn1_load(data, *blob); asn1_start_tag(data, ASN1_APPLICATION(0)); asn1_check_OID(data, GENSEC_OID_KERBEROS5); @@ -99,6 +108,8 @@ BOOL gensec_gssapi_check_oid(const DATA_BLOB *blob, const char *oid) BOOL ret; struct asn1_data *data = asn1_init(NULL); + if (!data) return False; + asn1_load(data, *blob); asn1_start_tag(data, ASN1_APPLICATION(0)); asn1_check_OID(data, oid); -- cgit From 0479a2f1cbae51fcd8dbdc3c148c808421fb4d25 Mon Sep 17 00:00:00 2001 From: Andrew Tridgell Date: Tue, 10 Jul 2007 02:07:03 +0000 Subject: r23792: convert Samba4 to GPLv3 There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa) --- source4/auth/kerberos/gssapi_parse.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index de6fa31afb..27c96770a6 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -9,7 +9,7 @@ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or + the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, @@ -18,8 +18,7 @@ GNU General Public License for more details. You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + along with this program. If not, see . */ #include "includes.h" -- cgit From 3642f3b40d755209a843745f160a9d7962a6deca Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Sat, 6 Oct 2007 22:16:19 +0000 Subject: r25552: Convert to standard bool type. (This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245) --- source4/auth/kerberos/gssapi_parse.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index 27c96770a6..4b1b178238 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -64,14 +64,14 @@ DATA_BLOB gensec_gssapi_gen_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *tick /* parse a krb5 GSS-API wrapper packet giving a ticket */ -BOOL gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2]) +bool gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, DATA_BLOB *ticket, uint8_t tok_id[2]) { - BOOL ret; + bool ret; struct asn1_data *data = asn1_init(mem_ctx); int data_remaining; if (!data) { - return False; + return false; } asn1_load(data, *blob); @@ -81,7 +81,7 @@ BOOL gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, D data_remaining = asn1_tag_remaining(data); if (data_remaining < 3) { - data->has_error = True; + data->has_error = true; } else { asn1_read(data, tok_id, 2); data_remaining -= 2; @@ -102,12 +102,12 @@ BOOL gensec_gssapi_parse_krb5_wrap(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, D /* check a GSS-API wrapper packet givin an expected OID */ -BOOL gensec_gssapi_check_oid(const DATA_BLOB *blob, const char *oid) +bool gensec_gssapi_check_oid(const DATA_BLOB *blob, const char *oid) { - BOOL ret; + bool ret; struct asn1_data *data = asn1_init(NULL); - if (!data) return False; + if (!data) return false; asn1_load(data, *blob); asn1_start_tag(data, ASN1_APPLICATION(0)); -- cgit From 939edd0eb7c3952859afb802c8e542449a2c4031 Mon Sep 17 00:00:00 2001 From: Jelmer Vernooij Date: Tue, 15 Jan 2008 01:04:38 +0100 Subject: util: Move asn1 to lib/util to trim down the number of subsystems. (This used to be commit 44e1cfd2d0ef62e4ee541cec00581a7151d951b3) --- source4/auth/kerberos/gssapi_parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'source4/auth/kerberos/gssapi_parse.c') diff --git a/source4/auth/kerberos/gssapi_parse.c b/source4/auth/kerberos/gssapi_parse.c index 4b1b178238..77e907d3fa 100644 --- a/source4/auth/kerberos/gssapi_parse.c +++ b/source4/auth/kerberos/gssapi_parse.c @@ -22,7 +22,7 @@ */ #include "includes.h" -#include "libcli/util/asn_1.h" +#include "lib/util/asn1.h" #include "auth/gensec/gensec.h" /* -- cgit