summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--doc/admin/conf_files/krb5_conf.rst3
-rw-r--r--src/plugins/preauth/pkinit/pkinit.h15
-rw-r--r--src/plugins/preauth/pkinit/pkinit_clnt.c70
-rw-r--r--src/plugins/preauth/pkinit/pkinit_crypto_openssl.c199
4 files changed, 45 insertions, 242 deletions
diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
index 387da6062..c6ded33d1 100644
--- a/doc/admin/conf_files/krb5_conf.rst
+++ b/doc/admin/conf_files/krb5_conf.rst
@@ -1055,9 +1055,6 @@ PKINIT krb5.conf options
times. Its value should contain the acceptable hostname for the
KDC (as contained in its certificate).
-**pkinit_longhorn**
- If this flag is set to true, we are talking to the Longhorn KDC.
-
**pkinit_pool**
Specifies the location of intermediate certificates which may be
used by the client to complete the trust chain between a KDC
diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
index 328dee5b7..e21fc81be 100644
--- a/src/plugins/preauth/pkinit/pkinit.h
+++ b/src/plugins/preauth/pkinit/pkinit.h
@@ -40,20 +40,6 @@
#include "pkinit_accessor.h"
#include "pkinit_trace.h"
-/*
- * It is anticipated that all the special checks currently
- * required when talking to a Longhorn server will go away
- * by the time it is officially released and all references
- * to the longhorn global can be removed and any code
- * #ifdef'd with LONGHORN_BETA_COMPAT can be removed.
- * And this #define!
- */
-#define LONGHORN_BETA_COMPAT 1
-#ifdef LONGHORN_BETA_COMPAT
-extern int longhorn; /* XXX Talking to a Longhorn server? */
-#endif
-
-
#ifndef WITHOUT_PKCS11
#include "pkcs11.h"
@@ -88,7 +74,6 @@ extern int longhorn; /* XXX Talking to a Longhorn server? */
#define KRB5_CONF_PKINIT_IDENTITY "pkinit_identity"
#define KRB5_CONF_PKINIT_KDC_HOSTNAME "pkinit_kdc_hostname"
#define KRB5_CONF_PKINIT_KDC_OCSP "pkinit_kdc_ocsp"
-#define KRB5_CONF_PKINIT_LONGHORN "pkinit_longhorn"
#define KRB5_CONF_PKINIT_POOL "pkinit_pool"
#define KRB5_CONF_PKINIT_REQUIRE_CRL_CHECKING "pkinit_require_crl_checking"
#define KRB5_CONF_PKINIT_REVOKE "pkinit_revoke"
diff --git a/src/plugins/preauth/pkinit/pkinit_clnt.c b/src/plugins/preauth/pkinit/pkinit_clnt.c
index b1c92dd02..742564b27 100644
--- a/src/plugins/preauth/pkinit/pkinit_clnt.c
+++ b/src/plugins/preauth/pkinit/pkinit_clnt.c
@@ -43,19 +43,6 @@
#include "pkinit.h"
#include "k5-json.h"
-/*
- * It is anticipated that all the special checks currently
- * required when talking to a Longhorn server will go away
- * by the time it is officially released and all references
- * to the longhorn global can be removed and any code
- * #ifdef'd with LONGHORN_BETA_COMPAT can be removed.
- *
- * Current testing (20070620) is against a patched Beta 3
- * version of Longhorn. Most, if not all, problems should
- * be fixed in SP1 of Longhorn.
- */
-int longhorn = 0; /* Talking to a Longhorn server? */
-
/**
* Return true if we should use ContentInfo rather than SignedData. This
* happens if we are talking to what might be an old (pre-6112) MIT KDC and
@@ -192,8 +179,8 @@ pa_pkinit_gen_req(krb5_context context,
* in order to get the Checksum rather than a Nonce in the reply.
* This can be removed when LH SP1 is released.
*/
- if ((return_pa_data[0]->pa_type == KRB5_PADATA_PK_AS_REP_OLD
- && reqctx->opts->win2k_require_cksum) || (longhorn == 1)) {
+ if (return_pa_data[0]->pa_type == KRB5_PADATA_PK_AS_REP_OLD &&
+ reqctx->opts->win2k_require_cksum) {
return_pa_data[1] = k5alloc(sizeof(*return_pa_data[1]), &retval);
if (return_pa_data[1] == NULL)
goto cleanup;
@@ -829,34 +816,24 @@ pkinit_as_rep_parse(krb5_context context,
if ((retval = k5int_decode_krb5_reply_key_pack(&k5data,
&key_pack)) != 0) {
pkiDebug("failed to decode reply_key_pack\n");
-#ifdef LONGHORN_BETA_COMPAT
- /*
- * LH Beta 3 requires the extra pa-data, even for RFC requests,
- * in order to get the Checksum rather than a Nonce in the reply.
- * This can be removed when LH SP1 is released.
- */
- if (pa_type == KRB5_PADATA_PK_AS_REP && longhorn == 0)
-#else
- if (pa_type == KRB5_PADATA_PK_AS_REP)
-#endif
- goto cleanup;
- else {
- if ((retval =
- k5int_decode_krb5_reply_key_pack_draft9(&k5data,
- &key_pack9)) != 0) {
- pkiDebug("failed to decode reply_key_pack_draft9\n");
- goto cleanup;
- }
- pkiDebug("decode reply_key_pack_draft9\n");
- if (key_pack9->nonce != request->nonce) {
- pkiDebug("nonce in AS_REP=%d doesn't match AS_REQ=%d\n", key_pack9->nonce, request->nonce);
- retval = -1;
- goto cleanup;
- }
- krb5_copy_keyblock_contents(context, &key_pack9->replyKey,
- key_block);
- break;
- }
+ if (pa_type == KRB5_PADATA_PK_AS_REP)
+ goto cleanup;
+ retval = k5int_decode_krb5_reply_key_pack_draft9(&k5data,
+ &key_pack9);
+ if (retval) {
+ pkiDebug("failed to decode reply_key_pack_draft9\n");
+ goto cleanup;
+ }
+ pkiDebug("decode reply_key_pack_draft9\n");
+ if (key_pack9->nonce != request->nonce) {
+ pkiDebug("nonce in AS_REP=%d doesn't match AS_REQ=%d\n",
+ key_pack9->nonce, request->nonce);
+ retval = -1;
+ goto cleanup;
+ }
+ krb5_copy_keyblock_contents(context, &key_pack9->replyKey,
+ key_block);
+ break;
}
/*
* This is hack but Windows sends back SHA1 checksum
@@ -986,13 +963,6 @@ pkinit_client_profile(krb5_context context,
}
free(eku_string);
}
-#ifdef LONGHORN_BETA_COMPAT
- /* Temporarily just set global flag from config file */
- pkinit_libdefault_boolean(context, realm,
- KRB5_CONF_PKINIT_LONGHORN,
- 0,
- &longhorn);
-#endif
/* Only process anchors here if they were not specified on command line */
if (reqctx->idopts->anchors == NULL)
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 1d6b0cd7a..08fdc24ff 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -155,16 +155,9 @@ create_krb5_invalidCertificates(krb5_context context,
static krb5_error_code
create_identifiers_from_stack(STACK_OF(X509) *sk,
krb5_external_principal_identifier *** ids);
-#ifdef LONGHORN_BETA_COMPAT
-static int
-wrap_signeddata(unsigned char *data, unsigned int data_len,
- unsigned char **out, unsigned int *out_len,
- int is_longhorn_server);
-#else
static int
wrap_signeddata(unsigned char *data, unsigned int data_len,
unsigned char **out, unsigned int *out_len);
-#endif
static char *
pkinit_pkcs11_code_to_text(int err);
@@ -1953,29 +1946,6 @@ cms_envelopeddata_verify(krb5_context context,
* For draft9-compatible, we don't do anything because it
* is already wrapped.
*/
-#ifdef LONGHORN_BETA_COMPAT
- /*
- * The Longhorn server returns the expected RFC-style data, but
- * it is missing the sequence tag and length, so it requires
- * special processing when wrapping.
- * This will hopefully be fixed before the final release and
- * this can all be removed.
- */
- if (msg_type == CMS_ENVEL_SERVER || longhorn == 1) {
- retval = wrap_signeddata(tmp_buf, tmp_buf_len,
- &tmp_buf2, &tmp_buf2_len, longhorn);
- if (retval) {
- pkiDebug("failed to encode signeddata\n");
- goto cleanup;
- }
- vfy_buf = tmp_buf2;
- vfy_buf_len = tmp_buf2_len;
-
- } else {
- vfy_buf = tmp_buf;
- vfy_buf_len = tmp_buf_len;
- }
-#else
if (msg_type == CMS_ENVEL_SERVER) {
retval = wrap_signeddata(tmp_buf, tmp_buf_len,
&tmp_buf2, &tmp_buf2_len);
@@ -1990,7 +1960,6 @@ cms_envelopeddata_verify(krb5_context context,
vfy_buf = tmp_buf;
vfy_buf_len = tmp_buf_len;
}
-#endif
#ifdef DEBUG_ASN1
print_buffer_bin(vfy_buf, vfy_buf_len, "/tmp/client_enc_keypack2");
@@ -3458,112 +3427,6 @@ pkinit_pkcs7type2oid(pkinit_plg_crypto_context cryptoctx, int pkcs7_type)
}
-#ifdef LONGHORN_BETA_COMPAT
-#if 0
-/*
- * This is a version that worked with Longhorn Beta 3.
- */
-static int
-wrap_signeddata(unsigned char *data, unsigned int data_len,
- unsigned char **out, unsigned int *out_len,
- int is_longhorn_server)
-{
-
- unsigned int orig_len = 0, oid_len = 0, tot_len = 0;
- ASN1_OBJECT *oid = NULL;
- unsigned char *p = NULL;
-
- pkiDebug("%s: This is the Longhorn version and is_longhorn_server = %d\n",
- __FUNCTION__, is_longhorn_server);
-
- /* Get length to wrap the original data with SEQUENCE tag */
- tot_len = orig_len = ASN1_object_size(1, (int)data_len, V_ASN1_SEQUENCE);
-
- if (is_longhorn_server == 0) {
- /* Add the signedData OID and adjust lengths */
- oid = OBJ_nid2obj(NID_pkcs7_signed);
- oid_len = i2d_ASN1_OBJECT(oid, NULL);
-
- tot_len = ASN1_object_size(1, (int)(orig_len+oid_len), V_ASN1_SEQUENCE);
- }
-
- p = *out = malloc(tot_len);
- if (p == NULL) return -1;
-
- if (is_longhorn_server == 0) {
- ASN1_put_object(&p, 1, (int)(orig_len+oid_len),
- V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
-
- i2d_ASN1_OBJECT(oid, &p);
-
- ASN1_put_object(&p, 1, (int)data_len, 0, V_ASN1_CONTEXT_SPECIFIC);
- } else {
- ASN1_put_object(&p, 1, (int)data_len, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
- }
- memcpy(p, data, data_len);
-
- *out_len = tot_len;
-
- return 0;
-}
-#else
-/*
- * This is a version that works with a patched Longhorn KDC.
- * (Which should match SP1 ??).
- */
-static int
-wrap_signeddata(unsigned char *data, unsigned int data_len,
- unsigned char **out, unsigned int *out_len,
- int is_longhorn_server)
-{
-
- unsigned int oid_len = 0, tot_len = 0, wrap_len = 0, tag_len = 0;
- ASN1_OBJECT *oid = NULL;
- unsigned char *p = NULL;
-
- pkiDebug("%s: This is the Longhorn version and is_longhorn_server = %d\n",
- __FUNCTION__, is_longhorn_server);
-
- /* New longhorn is missing another sequence */
- if (is_longhorn_server == 1)
- wrap_len = ASN1_object_size(1, (int)(data_len), V_ASN1_SEQUENCE);
- else
- wrap_len = data_len;
-
- /* Get length to wrap the original data with SEQUENCE tag */
- tag_len = ASN1_object_size(1, (int)wrap_len, V_ASN1_SEQUENCE);
-
- /* Always add oid */
- oid = OBJ_nid2obj(NID_pkcs7_signed);
- oid_len = i2d_ASN1_OBJECT(oid, NULL);
- oid_len += tag_len;
-
- tot_len = ASN1_object_size(1, (int)(oid_len), V_ASN1_SEQUENCE);
-
- p = *out = malloc(tot_len);
- if (p == NULL)
- return -1;
-
- ASN1_put_object(&p, 1, (int)(oid_len),
- V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
-
- i2d_ASN1_OBJECT(oid, &p);
-
- ASN1_put_object(&p, 1, (int)wrap_len, 0, V_ASN1_CONTEXT_SPECIFIC);
-
- /* Wrap in extra seq tag */
- if (is_longhorn_server == 1) {
- ASN1_put_object(&p, 1, (int)data_len, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
- }
- memcpy(p, data, data_len);
-
- *out_len = tot_len;
-
- return 0;
-}
-
-#endif
-#else
static int
wrap_signeddata(unsigned char *data, unsigned int data_len,
unsigned char **out, unsigned int *out_len)
@@ -3597,7 +3460,6 @@ wrap_signeddata(unsigned char *data, unsigned int data_len,
return 0;
}
-#endif
static int
prepare_enc_data(unsigned char *indata,
@@ -5643,50 +5505,39 @@ create_identifiers_from_stack(STACK_OF(X509) *sk,
krb5_cas[i]->issuerAndSerialNumber.magic = 0;
krb5_cas[i]->issuerAndSerialNumber.data = NULL;
-#ifdef LONGHORN_BETA_COMPAT
- if (longhorn == 0) { /* XXX Longhorn doesn't like this */
-#endif
- is = PKCS7_ISSUER_AND_SERIAL_new();
- X509_NAME_set(&is->issuer, X509_get_issuer_name(x));
- M_ASN1_INTEGER_free(is->serial);
- is->serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(x));
- len = i2d_PKCS7_ISSUER_AND_SERIAL(is, NULL);
- if ((p = malloc((size_t) len)) == NULL)
- goto cleanup;
- krb5_cas[i]->issuerAndSerialNumber.data = (char *)p;
- i2d_PKCS7_ISSUER_AND_SERIAL(is, &p);
- krb5_cas[i]->issuerAndSerialNumber.length = len;
-#ifdef LONGHORN_BETA_COMPAT
- }
-#endif
+ is = PKCS7_ISSUER_AND_SERIAL_new();
+ X509_NAME_set(&is->issuer, X509_get_issuer_name(x));
+ M_ASN1_INTEGER_free(is->serial);
+ is->serial = M_ASN1_INTEGER_dup(X509_get_serialNumber(x));
+ len = i2d_PKCS7_ISSUER_AND_SERIAL(is, NULL);
+ p = malloc(len);
+ if (p == NULL)
+ goto cleanup;
+ krb5_cas[i]->issuerAndSerialNumber.data = (char *)p;
+ i2d_PKCS7_ISSUER_AND_SERIAL(is, &p);
+ krb5_cas[i]->issuerAndSerialNumber.length = len;
/* fill-in subjectKeyIdentifier */
krb5_cas[i]->subjectKeyIdentifier.length = 0;
krb5_cas[i]->subjectKeyIdentifier.magic = 0;
krb5_cas[i]->subjectKeyIdentifier.data = NULL;
-
-#ifdef LONGHORN_BETA_COMPAT
- if (longhorn == 0) { /* XXX Longhorn doesn't like this */
-#endif
- if (X509_get_ext_by_NID(x, NID_subject_key_identifier, -1) >= 0) {
- ASN1_OCTET_STRING *ikeyid = NULL;
-
- if ((ikeyid = X509_get_ext_d2i(x, NID_subject_key_identifier, NULL,
- NULL))) {
- len = i2d_ASN1_OCTET_STRING(ikeyid, NULL);
- if ((p = malloc((size_t) len)) == NULL)
- goto cleanup;
- krb5_cas[i]->subjectKeyIdentifier.data = (char *)p;
- i2d_ASN1_OCTET_STRING(ikeyid, &p);
- krb5_cas[i]->subjectKeyIdentifier.length = len;
- }
- if (ikeyid != NULL)
- ASN1_OCTET_STRING_free(ikeyid);
+ if (X509_get_ext_by_NID(x, NID_subject_key_identifier, -1) >= 0) {
+ ASN1_OCTET_STRING *ikeyid;
+
+ ikeyid = X509_get_ext_d2i(x, NID_subject_key_identifier, NULL,
+ NULL);
+ if (ikeyid != NULL) {
+ len = i2d_ASN1_OCTET_STRING(ikeyid, NULL);
+ p = malloc(len);
+ if (p == NULL)
+ goto cleanup;
+ krb5_cas[i]->subjectKeyIdentifier.data = (char *)p;
+ i2d_ASN1_OCTET_STRING(ikeyid, &p);
+ krb5_cas[i]->subjectKeyIdentifier.length = len;
+ ASN1_OCTET_STRING_free(ikeyid);
}
-#ifdef LONGHORN_BETA_COMPAT
}
-#endif
if (is != NULL) {
if (is->issuer != NULL)
X509_NAME_free(is->issuer);
generated by cgit (git 2.34.1) at 2024-05-06 21:34:35 +0000