1 /* 2 * Copyright (c) 1997, 1998 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <krb5_locl.h> 35 36 RCSID("$Id: build_auth.c,v 1.32 1999/12/02 17:05:08 joda Exp $"); 37 38 krb5_error_code 39 krb5_build_authenticator (krb5_context context, 40 krb5_auth_context auth_context, 41 krb5_enctype enctype, 42 krb5_creds *cred, 43 Checksum *cksum, 44 Authenticator **auth_result, 45 krb5_data *result) 46 { 47 Authenticator *auth; 48 u_char *buf = NULL; 49 size_t buf_size; 50 size_t len; 51 krb5_error_code ret; 52 krb5_crypto crypto; 53 54 auth = malloc(sizeof(*auth)); 55 if (auth == NULL) 56 return ENOMEM; 57 58 memset (auth, 0, sizeof(*auth)); 59 auth->authenticator_vno = 5; 60 copy_Realm(&cred->client->realm, &auth->crealm); 61 copy_PrincipalName(&cred->client->name, &auth->cname); 62 63 { 64 int32_t sec, usec; 65 66 krb5_us_timeofday (context, &sec, &usec); 67 auth->ctime = sec; 68 auth->cusec = usec; 69 } 70 ret = krb5_auth_con_getlocalsubkey(context, auth_context, &auth->subkey); 71 if(ret) 72 goto fail; 73 74 if(auth->subkey == NULL) { 75 krb5_generate_subkey (context, &cred->session, &auth->subkey); 76 ret = krb5_auth_con_setlocalsubkey(context, auth_context, auth->subkey); 77 if(ret) 78 goto fail; 79 } 80 81 if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) { 82 krb5_generate_seq_number (context, 83 &cred->session, 84 &auth_context->local_seqnumber); 85 ALLOC(auth->seq_number, 1); 86 *auth->seq_number = auth_context->local_seqnumber; 87 } else 88 auth->seq_number = NULL; 89 auth->authorization_data = NULL; 90 auth->cksum = cksum; 91 92 /* XXX - Copy more to auth_context? */ 93 94 if (auth_context) { 95 auth_context->authenticator->ctime = auth->ctime; 96 auth_context->authenticator->cusec = auth->cusec; 97 } 98 99 buf_size = 1024; 100 buf = malloc (buf_size); 101 if (buf == NULL) { 102 ret = ENOMEM; 103 goto fail; 104 } 105 106 do { 107 ret = krb5_encode_Authenticator (context, 108 buf + buf_size - 1, 109 buf_size, 110 auth, &len); 111 if (ret) { 112 if (ret == ASN1_OVERFLOW) { 113 u_char *tmp; 114 115 buf_size *= 2; 116 tmp = realloc (buf, buf_size); 117 if (tmp == NULL) { 118 ret = ENOMEM; 119 goto fail; 120 } 121 buf = tmp; 122 } else { 123 goto fail; 124 } 125 } 126 } while(ret == ASN1_OVERFLOW); 127 128 ret = krb5_crypto_init(context, &cred->session, enctype, &crypto); 129 ret = krb5_encrypt (context, 130 crypto, 131 KRB5_KU_AP_REQ_AUTH, 132 buf + buf_size - len, 133 len, 134 result); 135 krb5_crypto_destroy(context, crypto); 136 137 if (ret) 138 goto fail; 139 140 free (buf); 141 142 if (auth_result) 143 *auth_result = auth; 144 else { 145 /* Don't free the `cksum', it's allocated by the caller */ 146 auth->cksum = NULL; 147 free_Authenticator (auth); 148 free (auth); 149 } 150 return ret; 151 fail: 152 free_Authenticator (auth); 153 free (auth); 154 free (buf); 155 return ret; 156 } 157