KDC TGS FAST support

* Correct TGS armor key handling
* Use appropriate checksum type  for FAST responses from KDC
* FAST response handling for TGS replies and errors

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/fast@22142 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index 26f7884fe74bc18ab923183986f6cd4ad196dac9..5b7fbf199c653bb8b708d4e9fe0fad251b6662b2 100644 (file)
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -146,7 +146,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
     errcode = ASN1_BAD_ID;
     status = "Finding req_body";
 }
-    errcode = kdc_find_fast(&request, &encoded_req_body, NULL /*TGS key*/, state);
+    errcode = kdc_find_fast(&request, &encoded_req_body, NULL /*TGS key*/, NULL, state);
     if (errcode) {
        status = "error decoding FAST";
        goto errout;

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index cb05f4f25647c4891e36427de69b59a7978550c5..5af77304697b8ebc1815db9d18a7f1647c5f3ef6 100644 (file)
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -76,7 +76,7 @@ find_alternate_tgs(krb5_kdc_req *,krb5_db_entry *,
                    krb5_boolean *,int *);
 
 static krb5_error_code 
-prepare_error_tgs(krb5_kdc_req *,krb5_ticket *,int,
+prepare_error_tgs(struct kdc_request_state *, krb5_kdc_req *,krb5_ticket *,int,
                   krb5_principal,krb5_data **,const char *);
 
 static krb5_int32
@@ -166,7 +166,7 @@ process_tgs_req(krb5_data *pkt, const krb5_fulladdr *from,
     }
     scratch.length = pa_tgs_req->length;
     scratch.data = (char *) pa_tgs_req->contents;
-    errcode = kdc_find_fast(&request, &scratch, subkey, state);
+    errcode = kdc_find_fast(&request, &scratch, subkey, header_ticket->enc_part2->session, state);
     if (errcode !=0) {
        status = "kdc_find_fast";
                goto cleanup;
@@ -873,7 +873,12 @@ tgt_again:
 
     reply.enc_part.enctype = subkey ? subkey->enctype :
     header_ticket->enc_part2->session->enctype;
-    errcode = krb5_encode_kdc_rep(kdc_context, KRB5_TGS_REP, &reply_encpart, 
+    errcode  = kdc_fast_response_handle_padata(state, request, &reply);
+    if (errcode !=0 ) {
+       status = "Preparing FAST padata";
+       goto cleanup;
+    }
+            errcode = krb5_encode_kdc_rep(kdc_context, KRB5_TGS_REP, &reply_encpart, 
                   subkey ? 1 : 0,
                   subkey ? subkey :
                   header_ticket->enc_part2->session,
@@ -914,7 +919,7 @@ cleanup:
         if (errcode < 0 || errcode > 128)
             errcode = KRB_ERR_GENERIC;
             
-        retval = prepare_error_tgs(request, header_ticket, errcode,
+        retval = prepare_error_tgs(state, request, header_ticket, errcode,
         nprincs ? server.princ : NULL,
                    response, status);
         if (got_err) {
@@ -956,7 +961,8 @@ cleanup:
 }
 
 static krb5_error_code
-prepare_error_tgs (krb5_kdc_req *request, krb5_ticket *ticket, int error,
+prepare_error_tgs (struct kdc_request_state *state,
+                  krb5_kdc_req *request, krb5_ticket *ticket, int error,
                    krb5_principal canon_server,
                    krb5_data **response, const char *status)
 {
@@ -979,14 +985,19 @@ prepare_error_tgs (krb5_kdc_req *request, krb5_ticket *ticket, int error,
     errpkt.text.length = strlen(status) + 1;
     if (!(errpkt.text.data = strdup(status)))
         return ENOMEM;
-
+    
     if (!(scratch = (krb5_data *)malloc(sizeof(*scratch)))) {
         free(errpkt.text.data);
         return ENOMEM;
     }
     errpkt.e_data.length = 0;
     errpkt.e_data.data = NULL;
-
+    retval = kdc_fast_handle_error(kdc_context, state, request, NULL, &errpkt);
+    if (retval) {
+       free(scratch);
+       free(errpkt.text.data);
+       return retval;
+    }
     retval = krb5_mk_error(kdc_context, &errpkt, scratch);
     free(errpkt.text.data);
     if (retval)

diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c
index 2a3106ac89d53d3288988123141ca32e9dc47c02..10d1d3eb61d853ca5ce9da238f5faab360eb9478 100644 (file)
--- a/src/kdc/fast_util.c
+++ b/src/kdc/fast_util.c
@@ -123,6 +123,7 @@ static krb5_error_code encrypt_fast_reply
 krb5_error_code  kdc_find_fast
 (krb5_kdc_req **requestptr,  krb5_data *checksummed_data,
  krb5_keyblock *tgs_subkey,
+ krb5_keyblock *tgs_session,
  struct kdc_request_state *state)
 {
     krb5_error_code retval = 0;
@@ -155,7 +156,10 @@ krb5_error_code  kdc_find_fast
     }
     if (retval == 0 && !state->armor_key) {
        if (tgs_subkey)
-           retval =krb5_copy_keyblock(kdc_context, tgs_subkey, &state->armor_key);
+         retval = krb5_c_fx_cf2_simple(kdc_context,
+                                       tgs_subkey, "subkeyarmor",
+                                       tgs_session, "ticketarmor",
+                                       &state->armor_key);
        else {
            krb5_set_error_message(kdc_context, KRB5KDC_ERR_PREAUTH_FAILED,
                                   "No armor key but FAST armored request present");
@@ -268,12 +272,15 @@ krb5_error_code kdc_fast_response_handle_padata
     krb5_data *encrypted_reply = NULL;
     krb5_pa_data *pa = NULL, **pa_array;
     krb5_cksumtype cksumtype = CKSUMTYPE_RSA_MD5;
+    krb5_pa_data *empty_padata[] = {NULL};
     
     if (!state->armor_key)
        return 0;
     memset(&finish, 0, sizeof(finish));
     fast_response.padata = rep->padata;
-    fast_response.rep_key = state->reply_key;
+    if (fast_response.padata == NULL)
+       fast_response.padata = &empty_padata[0];
+        fast_response.rep_key = state->reply_key;
     fast_response.nonce = request->nonce;
     fast_response.finished = &finish;
     finish.client = rep->client;
@@ -287,6 +294,8 @@ krb5_error_code kdc_fast_response_handle_padata
        retval = krb5_us_timeofday(kdc_context, &finish.timestamp, &finish.usec);
     if (retval == 0)
        retval = encode_krb5_ticket(rep->ticket, &encoded_ticket);
+    if (retval == 0)
+    retval = krb5int_c_mandatory_cksumtype(kdc_context, state->armor_key->enctype, &cksumtype);
     if (retval == 0)
        retval = krb5_c_make_checksum(kdc_context, cksumtype,
                                      state->armor_key, KRB5_KEYUSAGE_FAST_FINISHED,

diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h
index a54412528d1a27dfa7c3110a4914acbb82eb1736..90de8d39b7aa9694a2ba295e9b9ff9412baf06ff 100644 (file)
--- a/src/kdc/kdc_util.h
+++ b/src/kdc/kdc_util.h
@@ -319,7 +319,7 @@ enum krb5_fast_kdc_flags {
 
 krb5_error_code  kdc_find_fast
 (krb5_kdc_req **requestptr,  krb5_data *checksummed_data,
- krb5_keyblock *tgs_subkey,
+ krb5_keyblock *tgs_subkey, krb5_keyblock *tgs_session,
  struct kdc_request_state *state);
 
 krb5_error_code kdc_fast_response_handle_padata