Hide gak_fct interface and arguments in clpreauth

Remove the gak_fct, gak_data, salt, s2kparams, and as_key arguments
of krb5_clpreauth_process_fn and krb5_clpreauth_tryagain_fn.  To
replace them, add two callbacks: one which gets the AS key using the
previously selected etype-info2 information, and a second which lets
the module replace the AS key with one it has computed.

This changes limits module flexibility in a few ways.  Modules cannot
check whether the AS key was already obtained before asking for it,
and they cannot use the etype-info2 salt and s2kparams for purposes
other than getting the password-based AS key.  It is believed that
of existing preauth mechanisms, only SAM-2 preauth needs more
flexibility than the new interfaces provide, and as an internal legacy
mechanism it can cheat.  Future mechanisms should be okay since the
current IETF philosophy is that etype-info2 information should not be
used for other purposes.

ticket: 6976

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25351 dc483132-0cff-0310-8789-dd5450dbe970

1 files changed, 14 insertions, 25 deletions

diff --git a/src/include/krb5/preauth_plugin.h b/src/include/krb5/preauth_plugin.h
index 7d5dc99b1..869ebd5cd 100644
--- a/src/include/krb5/preauth_plugin.h
+++ b/src/include/krb5/preauth_plugin.h
@@ -143,23 +143,6 @@ typedef struct krb5_clpreauth_rock_st *krb5_clpreauth_rock;
 typedef struct krb5_clpreauth_moddata_st *krb5_clpreauth_moddata;
 typedef struct krb5_clpreauth_modreq_st *krb5_clpreauth_modreq;
 
-/*
- * Provided by krb5: a callback which will obtain the user's long-term AS key
- * by prompting the user for the password and converting it to a key using the
- * provided salt and s2kparams.  The resulting key will be placed in
- * as_key_out, which should be initialized to empty prior to the call.
- */
-typedef krb5_error_code
-(*krb5_clpreauth_get_as_key_fn)(krb5_context context,
-                                krb5_principal princ,
-                                krb5_enctype enctype,
-                                krb5_prompter_fct prompter,
-                                void *prompter_data,
-                                krb5_data *salt,
-                                krb5_data *s2kparams,
-                                krb5_keyblock *as_key_out,
-                                void *gak_data);
-
 /* Before using a callback after version 1, modules must check the vers
  * field of the callback structure. */
 typedef struct krb5_clpreauth_callbacks_st {
@@ -178,6 +161,20 @@ typedef struct krb5_clpreauth_callbacks_st {
     krb5_keyblock *(*fast_armor)(krb5_context context,
                                  krb5_clpreauth_rock rock);
 
+    /*
+     * Get a pointer to the client-supplied reply key, possibly invoking the
+     * prompter to ask for a password if this has not already been done.  The
+     * returned pointer is an alias and should not be freed.
+     */
+    krb5_error_code (*get_as_key)(krb5_context context,
+                                  krb5_clpreauth_rock rock,
+                                  krb5_keyblock **keyblock);
+
+    /* Replace the reply key to be used to decrypt the AS response. */
+    krb5_error_code (*set_as_key)(krb5_context context,
+                                  krb5_clpreauth_rock rock,
+                                  const krb5_keyblock *keyblock);
+
     /* End of version 1 clpreauth callbacks. */
 } *krb5_clpreauth_callbacks;
 
@@ -242,10 +239,6 @@ typedef krb5_error_code
                              krb5_data *encoded_previous_request,
                              krb5_pa_data *pa_data,
                              krb5_prompter_fct prompter, void *prompter_data,
-                             krb5_clpreauth_get_as_key_fn gak_fct,
-                             void *gak_data,
-                             krb5_data *salt, krb5_data *s2kparams,
-                             krb5_keyblock *as_key,
                              krb5_pa_data ***pa_data_out);
 
 /*
@@ -267,10 +260,6 @@ typedef krb5_error_code
                               krb5_pa_data *pa_data_in,
                               krb5_error *error,
                               krb5_prompter_fct prompter, void *prompter_data,
-                              krb5_clpreauth_get_as_key_fn gak_fct,
-                              void *gak_data,
-                              krb5_data *salt, krb5_data *s2kparams,
-                              krb5_keyblock *as_key,
                               krb5_pa_data ***pa_data_out);
 
 /*