This commit adds two new functions, krb5_server_decrypt_ticket_keyblock

  (private) and krb5_server_decrypt_ticket_keytab (public).  These
  functions take a krb5_ticket as input and decrypt it using the provided
  key data.  The public function is useful for higher level application
  protocols such a TLS-KRB5 and AFS RX-KRB5 which exchange a service 
  but do not use the AP-REQ/AP-REP messages.  

  This commit also adds new functionality to kvno which permits kvno 
  when provided a keytab as input to verify whether or not the keytab
  contains a key that can successfully decrypt the obtains service ticket.

ticket: 5349
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19062 dc483132-0cff-0310-8789-dd5450dbe970

4 files changed, 107 insertions, 0 deletions

diff --git a/src/lib/krb5/krb/Makefile.in b/src/lib/krb5/krb/Makefile.in
index 84b1f27bb..ebb2e8020 100644
--- a/src/lib/krb5/krb/Makefile.in
+++ b/src/lib/krb5/krb/Makefile.in
@@ -89,6 +89,7 @@ STLIBOBJS= \
 	ser_princ.o	\
 	serialize.o	\
 	set_realm.o	\
+	srv_dec_tkt.o	\
 	srv_rcache.o	\
 	str_conv.o	\
 	tgtname.o	\
@@ -175,6 +176,7 @@ OBJS=	$(OUTPRE)addr_comp.$(OBJEXT)	\
 	$(OUTPRE)ser_princ.$(OBJEXT)	\
 	$(OUTPRE)serialize.$(OBJEXT)	\
 	$(OUTPRE)set_realm.$(OBJEXT)	\
+	$(OUTPRE)srv_dec_tkt.$(OBJEXT)	\
 	$(OUTPRE)srv_rcache.$(OBJEXT)	\
 	$(OUTPRE)str_conv.$(OBJEXT)	\
 	$(OUTPRE)tgtname.$(OBJEXT)	\
@@ -262,6 +264,7 @@ SRCS=	$(srcdir)/addr_comp.c	\
 	$(srcdir)/ser_princ.c	\
 	$(srcdir)/serialize.c	\
 	$(srcdir)/set_realm.c	\
+	$(srcdir)/srv_dec_tkt.c	\
 	$(srcdir)/srv_rcache.c	\
 	$(srcdir)/str_conv.c	\
 	$(srcdir)/tgtname.c	\
@@ -1041,6 +1044,15 @@ set_realm.so set_realm.po $(OUTPRE)set_realm.$(OBJEXT): \
   $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
   $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
   set_realm.c
+srv_dec_tkt.so srv_dec_tkt.po $(OUTPRE)srv_dec_tkt.$(OBJEXT): \
+  $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
+  $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
+  $(COM_ERR_DEPS) $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-int.h \
+  $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \
+  $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \
+  $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \
+  $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \
+  srv_dec_tkt.c
 srv_rcache.so srv_rcache.po $(OUTPRE)srv_rcache.$(OBJEXT): \
   $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \
   $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \
diff --git a/src/lib/krb5/krb/srv_dec_tkt.c b/src/lib/krb5/krb/srv_dec_tkt.c
new file mode 100644
index 000000000..5fce58eb4
--- /dev/null
+++ b/src/lib/krb5/krb/srv_dec_tkt.c
@@ -0,0 +1,93 @@
+/*

+ * lib/krb5/krb/srv_dec_tkt.c

+ *

+ * Copyright 2006 by the Massachusetts Institute of Technology.

+ * All Rights Reserved.

+ *

+ * Export of this software from the United States of America may

+ *   require a specific license from the United States Government.

+ *   It is the responsibility of any person or organization contemplating

+ *   export to obtain such a license before exporting.

+ *

+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and

+ * distribute this software and its documentation for any purpose and

+ * without fee is hereby granted, provided that the above copyright

+ * notice appear in all copies and that both that copyright notice and

+ * this permission notice appear in supporting documentation, and that

+ * the name of M.I.T. not be used in advertising or publicity pertaining

+ * to distribution of the software without specific, written prior

+ * permission.  Furthermore if you modify this software you must label

+ * your software as modified software and not distribute it in such a

+ * fashion that it might be confused with the original M.I.T. software.

+ * M.I.T. makes no representations about the suitability of

+ * this software for any purpose.  It is provided "as is" without express

+ * or implied warranty.

+ *

+ *

+ * Server decrypt ticket via keytab or keyblock. 

+ *

+ * Different from krb5_rd_req_decoded. (krb5/src/lib/krb5/krb/rd_req_dec.c)

+ *   - No krb5_principal_compare or KRB5KRB_AP_ERR_BADMATCH error.

+ *   - No replay cache processing.

+ *   - No skew checking or KRB5KRB_AP_ERR_SKEW error.

+ *   - No address checking or KRB5KRB_AP_ERR_BADADDR error.

+ *   - No time validation.

+ *   - No permitted enctype validation or KRB5_NOPERM_ETYPE error.

+ *   - Does not free ticket->enc_part2 on error. 

+ */

+

+#include <k5-int.h>

+

+krb5_error_code KRB5_CALLCONV

+krb5_server_decrypt_ticket_keyblock(krb5_context context, 

+				    const krb5_keyblock *key,

+				    krb5_ticket *ticket)

+{

+    krb5_error_code retval;

+    krb5_data *realm;

+    krb5_transited *trans;

+

+    retval = krb5_decrypt_tkt_part(context, key, ticket);

+    if (retval) 

+	goto done;

+

+    trans = &ticket->enc_part2->transited;

+    realm = &ticket->enc_part2->client->realm;

+    if (trans->tr_contents.data && *trans->tr_contents.data) {

+	retval = krb5_check_transited_list(context, &trans->tr_contents,

+					   realm, &ticket->server->realm);

+	goto done;

+    }

+

+    if (ticket->enc_part2->flags & TKT_FLG_INVALID) {	/* ie, KDC_OPT_POSTDATED */

+	retval = KRB5KRB_AP_ERR_TKT_INVALID;

+	goto done;

+    }

+

+  done:

+    return retval;

+}

+

+

+krb5_error_code	KRB5_CALLCONV

+krb5_server_decrypt_ticket_keytab(krb5_context context,

+				  const krb5_keytab kt,

+				  krb5_ticket *ticket)

+{

+    krb5_error_code       retval;

+    krb5_enctype          enctype;

+    krb5_keytab_entry     ktent;

+

+    enctype = ticket->enc_part.enctype;

+

+    if ((retval = krb5_kt_get_entry(context, kt, ticket->server,

+                                    ticket->enc_part.kvno,

+                                    enctype, &ktent)))

+        return retval;

+

+    retval = krb5_server_decrypt_ticket_keyblock(context, &ktent.key, ticket);

+    /* Upon error, Free keytab entry first, then return */

+

+    (void) krb5_kt_free_entry(context, &ktent);

+    return retval;

+}

diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports
index 702cf4a2c..8446e5209 100644
--- a/src/lib/krb5/libkrb5.exports
+++ b/src/lib/krb5/libkrb5.exports
@@ -614,6 +614,7 @@ krb5_ser_rcache_init
 krb5_ser_unpack_bytes
 krb5_ser_unpack_int32
 krb5_ser_unpack_int64
+krb5_server_decrypt_ticket_keytab
 krb5_set_config_files
 krb5_set_debugging_time
 krb5_set_default_in_tkt_ktypes
diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def
index f767c6de1..078b8cae9 100644
--- a/src/lib/krb5_32.def
+++ b/src/lib/krb5_32.def
@@ -219,6 +219,7 @@ krb5_c_string_to_key_with_params
 	krb5_recvauth_version
 	krb5_salttype_to_string
 	krb5_sendauth
+	krb5_server_decrypt_ticket_keytab
 	krb5_set_default_realm
 	krb5_set_default_tgs_enctypes
         krb5_set_password