if (code != 0)
goto cleanup;
ctx->preauth_rock.fast_state = ctx->fast_state;
- krb5_preauth_request_context_init(context);
+ k5_preauth_request_context_init(context);
if (ctx->outer_request_body) {
krb5_free_data(context, ctx->outer_request_body);
ctx->outer_request_body = NULL;
goto cleanup;
}
/* give the preauth plugins a chance to prep the request body */
- krb5_preauth_prepare_request(context, ctx->opte, ctx->request);
+ k5_preauth_prepare_request(context, ctx->opte, ctx->request);
/* Omit request start time in the common case. MIT and Heimdal KDCs will
* ignore it for non-postdated tickets anyway. */
free(ctx->in_tkt_service);
ctx->in_tkt_service = s;
- krb5_preauth_request_context_fini(context);
+ k5_preauth_request_context_fini(context);
return restart_init_creds_loop(context, ctx, NULL);
}
if (ctx->err_reply == NULL) {
/* either our first attempt, or retrying after PREAUTH_NEEDED */
- code = krb5_do_preauth(context,
- ctx->request,
- ctx->inner_request_body,
- ctx->encoded_previous_request,
- ctx->preauth_to_use,
- &ctx->request->padata,
- ctx->prompter,
- ctx->prompter_data,
- &ctx->preauth_rock,
- ctx->opte,
- &got_real);
+ code = k5_preauth(context, ctx->opte, &ctx->preauth_rock, ctx->request,
+ ctx->inner_request_body,
+ ctx->encoded_previous_request, ctx->preauth_to_use,
+ ctx->prompter, ctx->prompter_data,
+ &ctx->request->padata, &got_real);
if (code == 0 && !got_real && ctx->preauth_required)
code = KRB5_PREAUTH_FAILED;
if (code != 0)
* Retry after an error other than PREAUTH_NEEDED,
* using ctx->err_padata to figure out what to change.
*/
- code = krb5_do_preauth_tryagain(context,
- ctx->request,
- ctx->inner_request_body,
- ctx->encoded_previous_request,
- ctx->preauth_to_use,
- &ctx->request->padata,
- ctx->err_reply,
- ctx->err_padata,
- ctx->prompter,
- ctx->prompter_data,
- &ctx->preauth_rock,
- ctx->opte);
+ code = k5_preauth_tryagain(context, ctx->opte, &ctx->preauth_rock,
+ ctx->request, ctx->inner_request_body,
+ ctx->encoded_previous_request,
+ ctx->preauth_to_use, ctx->err_reply,
+ ctx->err_padata, ctx->prompter,
+ ctx->prompter_data,
+ &ctx->request->padata);
} else {
/* No preauth supplied, so can't query the plugins. */
code = KRB5KRB_ERR_GENERIC;
goto cleanup;
if (negotiation_requests_restart(context, ctx, ctx->err_padata)) {
ctx->have_restarted = 1;
- krb5_preauth_request_context_fini(context);
+ k5_preauth_request_context_fini(context);
if ((ctx->fast_state->fast_state_flags & KRB5INT_FAST_DO_FAST) ==0)
ctx->enc_pa_rep_permitted = 0;
code = restart_init_creds_loop(context, ctx, ctx->err_padata);
ctx->err_padata = NULL;
note_req_timestamp(context, &ctx->preauth_rock,
ctx->err_reply->stime, ctx->err_reply->susec);
- /* this will trigger a new call to krb5_do_preauth() */
+ /* This will trigger a new call to k5_preauth(). */
krb5_free_error(context, ctx->err_reply);
ctx->err_reply = NULL;
code = sort_krb5_padata_sequence(context,
code = krb5int_copy_data_contents(context,
&ctx->err_reply->client->realm,
&ctx->request->client->realm);
- /* this will trigger a new call to krb5_do_preauth() */
+ /* This will trigger a new call to k5_preauth(). */
krb5_free_error(context, ctx->err_reply);
ctx->err_reply = NULL;
- krb5_preauth_request_context_fini(context);
+ k5_preauth_request_context_fini(context);
/* Permit another negotiation based restart. */
ctx->have_restarted = 0;
ctx->sent_nontrivial_preauth = 0;
goto cleanup;
/* process any preauth data in the as_reply */
- krb5_clear_preauth_context_use_counts(context);
+ k5_reset_preauth_types_tried(context);
code = krb5int_fast_process_response(context, ctx->fast_state,
ctx->reply, &strengthen_key);
if (code != 0)
ctx->allowed_preauth_type = KRB5_PADATA_NONE;
ctx->preauth_rock.selected_preauth_type = NULL;
- code = krb5_do_preauth(context,
- ctx->request,
- ctx->inner_request_body,
- ctx->encoded_previous_request,
- ctx->reply->padata,
- &kdc_padata,
- ctx->prompter,
- ctx->prompter_data,
- &ctx->preauth_rock,
- ctx->opte,
- &got_real);
+ code = k5_preauth(context, ctx->opte, &ctx->preauth_rock, ctx->request,
+ ctx->inner_request_body, ctx->encoded_previous_request,
+ ctx->reply->padata, ctx->prompter, ctx->prompter_data,
+ &kdc_padata, &got_real);
if (code != 0)
goto cleanup;
}
}
- krb5_preauth_request_context_fini(context);
+ k5_preauth_request_context_fini(context);
/* success */
code = 0;
}
/* Initialize the preauth state for a krb5 context. */
-void KRB5_CALLCONV
-krb5_init_preauth_context(krb5_context kcontext)
+void
+k5_init_preauth_context(krb5_context context)
{
krb5_plugin_initvt_fn *modules = NULL, *mod;
clpreauth_handle *list = NULL, h, h2;
krb5_preauthtype *tp;
/* Only do this once for each krb5_context */
- if (kcontext->preauth_context != NULL)
+ if (context->preauth_context != NULL)
return;
/* Auto-register built-in modules. */
- k5_plugin_register_dyn(kcontext, PLUGIN_INTERFACE_CLPREAUTH, "pkinit",
+ k5_plugin_register_dyn(context, PLUGIN_INTERFACE_CLPREAUTH, "pkinit",
"preauth");
- k5_plugin_register(kcontext, PLUGIN_INTERFACE_CLPREAUTH,
+ k5_plugin_register(context, PLUGIN_INTERFACE_CLPREAUTH,
"encrypted_challenge",
clpreauth_encrypted_challenge_initvt);
- k5_plugin_register(kcontext, PLUGIN_INTERFACE_CLPREAUTH,
+ k5_plugin_register(context, PLUGIN_INTERFACE_CLPREAUTH,
"encrypted_timestamp",
clpreauth_encrypted_timestamp_initvt);
- k5_plugin_register(kcontext, PLUGIN_INTERFACE_CLPREAUTH, "sam2",
+ k5_plugin_register(context, PLUGIN_INTERFACE_CLPREAUTH, "sam2",
clpreauth_sam2_initvt);
- k5_plugin_register(kcontext, PLUGIN_INTERFACE_CLPREAUTH, "otp",
+ k5_plugin_register(context, PLUGIN_INTERFACE_CLPREAUTH, "otp",
clpreauth_otp_initvt);
/* Get all available clpreauth vtables. */
- if (k5_plugin_load_all(kcontext, PLUGIN_INTERFACE_CLPREAUTH, &modules))
+ if (k5_plugin_load_all(context, PLUGIN_INTERFACE_CLPREAUTH, &modules))
return;
/* Allocate a large enough list of handles. */
goto cleanup;
/* Initialize the handle vtable. */
- if ((*mod)(kcontext, 1, 1, (krb5_plugin_vtable)&h->vt) != 0) {
+ if ((*mod)(context, 1, 1, (krb5_plugin_vtable)&h->vt) != 0) {
free(h);
continue;
}
for (tp = h->vt.pa_type_list; *tp != 0; tp++) {
h2 = find_module(list, *tp);
if (h2 != NULL) {
- TRACE_PREAUTH_CONFLICT(kcontext, h->vt.name, h2->vt.name, *tp);
+ TRACE_PREAUTH_CONFLICT(context, h->vt.name, h2->vt.name, *tp);
break;
}
}
/* Initialize the module data. */
h->data = NULL;
- if (h->vt.init != NULL && h->vt.init(kcontext, &h->data) != 0) {
+ if (h->vt.init != NULL && h->vt.init(context, &h->data) != 0) {
free(h);
continue;
}
list[count] = NULL;
/* Place the constructed preauth context into the krb5 context. */
- kcontext->preauth_context = malloc(sizeof(struct krb5_preauth_context_st));
- if (kcontext->preauth_context == NULL)
+ context->preauth_context = malloc(sizeof(struct krb5_preauth_context_st));
+ if (context->preauth_context == NULL)
goto cleanup;
- kcontext->preauth_context->tried = NULL;
- kcontext->preauth_context->handles = list;
+ context->preauth_context->tried = NULL;
+ context->preauth_context->handles = list;
list = NULL;
cleanup:
- k5_plugin_free_modules(kcontext, modules);
- free_handles(kcontext, list);
+ k5_plugin_free_modules(context, modules);
+ free_handles(context, list);
}
-/* Zero the use counts for the modules herein. Usually used before we
- * start processing any data from the server, at which point every module
- * will again be able to take a crack at whatever the server sent. */
-void KRB5_CALLCONV
-krb5_clear_preauth_context_use_counts(krb5_context context)
+/*
+ * Reset the memory of which preauth types we have already tried, because we
+ * are entering a new phase of padata processing (such as the padata in an
+ * AS-REP).
+ */
+void
+k5_reset_preauth_types_tried(krb5_context context)
{
struct krb5_preauth_context_st *pctx = context->preauth_context;
/* Free the per-krb5_context preauth_context. This means clearing any
* plugin-specific context which may have been created, and then
* freeing the context itself. */
-void KRB5_CALLCONV
-krb5_free_preauth_context(krb5_context context)
+void
+k5_free_preauth_context(krb5_context context)
{
struct krb5_preauth_context_st *pctx = context->preauth_context;
/* Initialize the per-AS-REQ context. This means calling the client_req_init
* function to give the plugin a chance to allocate a per-request context. */
-void KRB5_CALLCONV
-krb5_preauth_request_context_init(krb5_context context)
+void
+k5_preauth_request_context_init(krb5_context context)
{
struct krb5_preauth_context_st *pctx = context->preauth_context;
clpreauth_handle *hp, h;
if (pctx == NULL) {
- krb5_init_preauth_context(context);
+ k5_init_preauth_context(context);
pctx = context->preauth_context;
if (pctx == NULL)
return;
}
- krb5_clear_preauth_context_use_counts(context);
+ k5_reset_preauth_types_tried(context);
for (hp = pctx->handles; *hp != NULL; hp++) {
h = *hp;
if (h->vt.request_init != NULL)
/* Free the per-AS-REQ context. This means clearing any request-specific
* context which the plugin may have created. */
-void KRB5_CALLCONV
-krb5_preauth_request_context_fini(krb5_context context)
+void
+k5_preauth_request_context_fini(krb5_context context)
{
struct krb5_preauth_context_st *pctx = context->preauth_context;
clpreauth_handle *hp, h;
/* Tweak the request body, for now adding any enctypes which the module claims
* to add support for to the list, but in the future perhaps doing more
* involved things. */
-void KRB5_CALLCONV
-krb5_preauth_prepare_request(krb5_context kcontext,
- krb5_gic_opt_ext *opte,
- krb5_kdc_req *request)
+void
+k5_preauth_prepare_request(krb5_context context, krb5_gic_opt_ext *opte,
+ krb5_kdc_req *req)
{
- struct krb5_preauth_context_st *pctx = kcontext->preauth_context;
+ struct krb5_preauth_context_st *pctx = context->preauth_context;
clpreauth_handle *hp, h;
krb5_enctype *ep;
if (h->vt.enctype_list == NULL)
continue;
for (ep = h->vt.enctype_list; *ep != ENCTYPE_NULL; ep++)
- grow_ktypes(&request->ktype, &request->nktypes, *ep);
+ grow_ktypes(&req->ktype, &req->nktypes, *ep);
}
}
* err_reply, return 0. If it's the sort of correction which requires that we
* ask the user another question, we let the calling application deal with it.
*/
-krb5_error_code KRB5_CALLCONV
-krb5_do_preauth_tryagain(krb5_context context, krb5_kdc_req *req,
- krb5_data *req_body, krb5_data *prev_req,
- krb5_pa_data **in_padata, krb5_pa_data ***out_padata,
- krb5_error *err_reply, krb5_pa_data **err_padata,
- krb5_prompter_fct prompter, void *prompter_data,
- krb5_clpreauth_rock rock, krb5_gic_opt_ext *opte)
+krb5_error_code
+k5_preauth_tryagain(krb5_context context, krb5_gic_opt_ext *opte,
+ krb5_clpreauth_rock rock, krb5_kdc_req *req,
+ krb5_data *req_body, krb5_data *prev_req,
+ krb5_pa_data **in_padata, krb5_error *err_reply,
+ krb5_pa_data **err_padata, krb5_prompter_fct prompter,
+ void *prompter_data, krb5_pa_data ***padata_out)
{
struct krb5_preauth_context_st *pctx = context->preauth_context;
krb5_error_code ret;
clpreauth_handle h;
int i;
- *out_padata = NULL;
+ *padata_out = NULL;
if (pctx == NULL)
return KRB5KRB_ERR_GENERIC;
TRACE_PREAUTH_TRYAGAIN_INPUT(context, in_padata);
for (i = 0; in_padata[i] != NULL; i++) {
- out_padata = NULL;
h = find_module(pctx->handles, in_padata[i]->pa_type);
if (h == NULL)
continue;
prompter_data, &mod_pa);
if (ret == 0 && mod_pa != NULL) {
TRACE_PREAUTH_TRYAGAIN_OUTPUT(context, mod_pa);
- *out_padata = mod_pa;
+ *padata_out = mod_pa;
return 0;
}
}
return 0;
}
-krb5_error_code KRB5_CALLCONV
-krb5_do_preauth(krb5_context context, krb5_kdc_req *req, krb5_data *req_body,
- krb5_data *prev_req, krb5_pa_data **in_padata,
- krb5_pa_data ***out_padata, krb5_prompter_fct prompter,
- void *prompter_data, krb5_clpreauth_rock rock,
- krb5_gic_opt_ext *opte, krb5_boolean *got_real_out)
+krb5_error_code
+k5_preauth(krb5_context context, krb5_gic_opt_ext *opte,
+ krb5_clpreauth_rock rock, krb5_kdc_req *req,
+ krb5_data *req_body, krb5_data *prev_req, krb5_pa_data **in_padata,
+ krb5_prompter_fct prompter, void *prompter_data,
+ krb5_pa_data ***padata_out, krb5_boolean *got_real_out)
{
int out_pa_list_size = 0;
krb5_pa_data **out_pa_list = NULL;
krb5_responder_fn responder = opte->opt_private->responder;
krb5_get_init_creds_opt *opt = (krb5_get_init_creds_opt *)opte;
- *out_padata = NULL;
+ *padata_out = NULL;
*got_real_out = FALSE;
if (in_padata == NULL)
}
/* If we can't initialize the preauth context, stop with what we have. */
- krb5_init_preauth_context(context);
+ k5_init_preauth_context(context);
if (context->preauth_context == NULL) {
- *out_padata = out_pa_list;
+ *padata_out = out_pa_list;
+ out_pa_list = NULL;
goto error;
}
goto error;
TRACE_PREAUTH_OUTPUT(context, out_pa_list);
- *out_padata = out_pa_list;
+ *padata_out = out_pa_list;
return 0;
error:
const char *emsg = NULL;
if (pctx == NULL) {
- krb5_init_preauth_context(context);
+ k5_init_preauth_context(context);
pctx = context->preauth_context;
if (pctx == NULL) {
krb5_set_error_message(context, EINVAL,
projects / thirdparty / krb5.git / commitdiff
