1 /* 2 * Copyright (c) 1997 - 2000 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <krb5_locl.h> 35 36 RCSID("$Id: build_auth.c,v 1.34 2000/11/15 06:58:51 assar Exp $"); 37 38 krb5_error_code 39 krb5_build_authenticator (krb5_context context, 40 krb5_auth_context auth_context, 41 krb5_enctype enctype, 42 krb5_creds *cred, 43 Checksum *cksum, 44 Authenticator **auth_result, 45 krb5_data *result, 46 krb5_key_usage usage) 47 { 48 Authenticator *auth; 49 u_char *buf = NULL; 50 size_t buf_size; 51 size_t len; 52 krb5_error_code ret; 53 krb5_crypto crypto; 54 55 auth = malloc(sizeof(*auth)); 56 if (auth == NULL) 57 return ENOMEM; 58 59 memset (auth, 0, sizeof(*auth)); 60 auth->authenticator_vno = 5; 61 copy_Realm(&cred->client->realm, &auth->crealm); 62 copy_PrincipalName(&cred->client->name, &auth->cname); 63 64 { 65 int32_t sec, usec; 66 67 krb5_us_timeofday (context, &sec, &usec); 68 auth->ctime = sec; 69 auth->cusec = usec; 70 } 71 ret = krb5_auth_con_getlocalsubkey(context, auth_context, &auth->subkey); 72 if(ret) 73 goto fail; 74 75 if(auth->subkey == NULL) { 76 krb5_generate_subkey (context, &cred->session, &auth->subkey); 77 ret = krb5_auth_con_setlocalsubkey(context, auth_context, auth->subkey); 78 if(ret) 79 goto fail; 80 } 81 82 if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) { 83 krb5_generate_seq_number (context, 84 &cred->session, 85 &auth_context->local_seqnumber); 86 ALLOC(auth->seq_number, 1); 87 *auth->seq_number = auth_context->local_seqnumber; 88 } else 89 auth->seq_number = NULL; 90 auth->authorization_data = NULL; 91 auth->cksum = cksum; 92 93 /* XXX - Copy more to auth_context? */ 94 95 if (auth_context) { 96 auth_context->authenticator->ctime = auth->ctime; 97 auth_context->authenticator->cusec = auth->cusec; 98 } 99 100 buf_size = 1024; 101 buf = malloc (buf_size); 102 if (buf == NULL) { 103 ret = ENOMEM; 104 goto fail; 105 } 106 107 do { 108 ret = krb5_encode_Authenticator (context, 109 buf + buf_size - 1, 110 buf_size, 111 auth, &len); 112 if (ret) { 113 if (ret == ASN1_OVERFLOW) { 114 u_char *tmp; 115 116 buf_size *= 2; 117 tmp = realloc (buf, buf_size); 118 if (tmp == NULL) { 119 ret = ENOMEM; 120 goto fail; 121 } 122 buf = tmp; 123 } else { 124 goto fail; 125 } 126 } 127 } while(ret == ASN1_OVERFLOW); 128 129 ret = krb5_crypto_init(context, &cred->session, enctype, &crypto); 130 if (ret) 131 goto fail; 132 ret = krb5_encrypt (context, 133 crypto, 134 usage /* KRB5_KU_AP_REQ_AUTH */, 135 buf + buf_size - len, 136 len, 137 result); 138 krb5_crypto_destroy(context, crypto); 139 140 if (ret) 141 goto fail; 142 143 free (buf); 144 145 if (auth_result) 146 *auth_result = auth; 147 else { 148 /* Don't free the `cksum', it's allocated by the caller */ 149 auth->cksum = NULL; 150 free_Authenticator (auth); 151 free (auth); 152 } 153 return ret; 154 fail: 155 free_Authenticator (auth); 156 free (auth); 157 free (buf); 158 return ret; 159 } 160