if KRB5_AUTH_CONTEXT_USE_SUBKEY set, mk_rep generates a new subkey

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/raeburn-gssapi-cfx@15860 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/mk_rep.c b/src/lib/krb5/krb/mk_rep.c
index 31f3fe50013888c25aeca5dd0044d196c33e314e..393f634bb1652dd0efbc0d645c06fd1c1fcc1c11 100644 (file)
--- a/src/lib/krb5/krb/mk_rep.c
+++ b/src/lib/krb5/krb/mk_rep.c
@@ -59,7 +59,14 @@ krb5_mk_rep(krb5_context context, krb5_auth_context auth_context, krb5_data *out
 
     repl.ctime = auth_context->authentp->ctime;    
     repl.cusec = auth_context->authentp->cusec;    
-    repl.subkey = auth_context->authentp->subkey;    
+    if (auth_context->auth_context_flags & KRB5_AUTH_CONTEXT_USE_SUBKEY) {
+       retval = krb5int_generate_and_save_subkey (context, auth_context,
+                                                  auth_context->keyblock);
+       if (retval)
+           return retval;
+       repl.subkey = auth_context->send_subkey;
+    } else
+       repl.subkey = auth_context->authentp->subkey;
     repl.seq_number = auth_context->local_seq_number;
 
     /* encode it before encrypting */

diff --git a/src/lib/krb5/krb/mk_req_ext.c b/src/lib/krb5/krb/mk_req_ext.c
index bac7ac0eeb7faa55729639858ad31d2af24ccaee..cdb8f6950d188e47f77def87d0bd3ea2c5e9b7e1 100644 (file)
--- a/src/lib/krb5/krb/mk_req_ext.c
+++ b/src/lib/krb5/krb/mk_req_ext.c
@@ -70,6 +70,38 @@ krb5_generate_authenticator (krb5_context,
                                       krb5_checksum *, krb5_keyblock *,
                                       krb5_ui_4, krb5_authdata ** );
 
+krb5_error_code
+krb5int_generate_and_save_subkey (krb5_context context,
+                                 krb5_auth_context auth_context,
+                                 krb5_keyblock *keyblock)
+{
+    /* Provide some more fodder for random number code.
+       This isn't strong cryptographically; the point here is not
+       to guarantee randomness, but to make it less likely that multiple
+       sessions could pick the same subkey.  */
+    struct {
+       krb5_int32 sec, usec;
+    } rnd_data;
+    krb5_data d;
+    krb5_error_code retval;
+
+    krb5_crypto_us_timeofday (&rnd_data.sec, &rnd_data.usec);
+    d.length = sizeof (rnd_data);
+    d.data = (char *) &rnd_data;
+    (void) krb5_c_random_add_entropy (context, KRB5_C_RANDSOURCE_TIMING, &d);
+
+    if ((retval = krb5_generate_subkey(context, keyblock, &auth_context->send_subkey)))
+       return retval;
+    retval = krb5_copy_keyblock(context, auth_context->send_subkey,
+                               &auth_context->recv_subkey);
+    if (retval) {
+       krb5_free_keyblock(context, auth_context->send_subkey);
+       auth_context->send_subkey = NULL;
+       return retval;
+    }
+    return 0;
+}
+
 krb5_error_code KRB5_CALLCONV
 krb5_mk_req_extended(krb5_context context, krb5_auth_context *auth_context,
                     krb5_flags ap_req_options, krb5_data *in_data,
@@ -131,29 +163,10 @@ krb5_mk_req_extended(krb5_context context, krb5_auth_context *auth_context,
     }
 
     if ((ap_req_options & AP_OPTS_USE_SUBKEY)&&(!(*auth_context)->send_subkey)) {
-       /* Provide some more fodder for random number code.
-          This isn't strong cryptographically; the point here is not
-          to guarantee randomness, but to make it less likely that multiple
-          sessions could pick the same subkey.  */
-       struct {
-           krb5_int32 sec, usec;
-       } rnd_data;
-       krb5_data d;
-       krb5_crypto_us_timeofday (&rnd_data.sec, &rnd_data.usec);
-       d.length = sizeof (rnd_data);
-       d.data = (char *) &rnd_data;
-       (void) krb5_c_random_add_entropy (context, KRB5_C_RANDSOURCE_TIMING, &d);
-
-       if ((retval = krb5_generate_subkey(context, &(in_creds)->keyblock, 
-                                          &(*auth_context)->send_subkey)))
-           goto cleanup;
-       retval = krb5_copy_keyblock(context, (*auth_context)->send_subkey,
-                                   &((*auth_context)->recv_subkey));
-       if (retval) {
-           krb5_free_keyblock(context, (*auth_context)->send_subkey);
-           (*auth_context)->send_subkey = NULL;
+       retval = krb5int_generate_and_save_subkey (context, *auth_context,
+                                                  &in_creds->keyblock);
+       if (retval)
            goto cleanup;
-       }
     }