From 7e0c27f227983df21297953d756746eeaab3204e Mon Sep 17 00:00:00 2001 From: Jeffrey Altman Date: Tue, 16 Jan 2007 04:18:02 +0000 Subject: This commit adds two new functions, krb5_server_decrypt_ticket_keyblock (private) and krb5_server_decrypt_ticket_keytab (public). These functions take a krb5_ticket as input and decrypt it using the provided key data. The public function is useful for higher level application protocols such a TLS-KRB5 and AFS RX-KRB5 which exchange a service but do not use the AP-REQ/AP-REP messages. This commit also adds new functionality to kvno which permits kvno when provided a keytab as input to verify whether or not the keytab contains a key that can successfully decrypt the obtains service ticket. ticket: 5349 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19062 dc483132-0cff-0310-8789-dd5450dbe970 --- src/lib/krb5/krb/Makefile.in | 12 ++++++ src/lib/krb5/krb/srv_dec_tkt.c | 93 ++++++++++++++++++++++++++++++++++++++++++ src/lib/krb5/libkrb5.exports | 1 + src/lib/krb5_32.def | 1 + 4 files changed, 107 insertions(+) create mode 100644 src/lib/krb5/krb/srv_dec_tkt.c (limited to 'src/lib') diff --git a/src/lib/krb5/krb/Makefile.in b/src/lib/krb5/krb/Makefile.in index 84b1f27bb..ebb2e8020 100644 --- a/src/lib/krb5/krb/Makefile.in +++ b/src/lib/krb5/krb/Makefile.in @@ -89,6 +89,7 @@ STLIBOBJS= \ ser_princ.o \ serialize.o \ set_realm.o \ + srv_dec_tkt.o \ srv_rcache.o \ str_conv.o \ tgtname.o \ @@ -175,6 +176,7 @@ OBJS= $(OUTPRE)addr_comp.$(OBJEXT) \ $(OUTPRE)ser_princ.$(OBJEXT) \ $(OUTPRE)serialize.$(OBJEXT) \ $(OUTPRE)set_realm.$(OBJEXT) \ + $(OUTPRE)srv_dec_tkt.$(OBJEXT) \ $(OUTPRE)srv_rcache.$(OBJEXT) \ $(OUTPRE)str_conv.$(OBJEXT) \ $(OUTPRE)tgtname.$(OBJEXT) \ @@ -262,6 +264,7 @@ SRCS= $(srcdir)/addr_comp.c \ $(srcdir)/ser_princ.c \ $(srcdir)/serialize.c \ $(srcdir)/set_realm.c \ + $(srcdir)/srv_dec_tkt.c \ $(srcdir)/srv_rcache.c \ $(srcdir)/str_conv.c \ $(srcdir)/tgtname.c \ @@ -1041,6 +1044,15 @@ set_realm.so set_realm.po $(OUTPRE)set_realm.$(OBJEXT): \ $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \ $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \ set_realm.c +srv_dec_tkt.so srv_dec_tkt.po $(OUTPRE)srv_dec_tkt.$(OBJEXT): \ + $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ + $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ + $(COM_ERR_DEPS) $(SRCTOP)/include/k5-err.h $(SRCTOP)/include/k5-int.h \ + $(SRCTOP)/include/k5-platform.h $(SRCTOP)/include/k5-plugin.h \ + $(SRCTOP)/include/k5-thread.h $(SRCTOP)/include/krb5.h \ + $(SRCTOP)/include/krb5/locate_plugin.h $(SRCTOP)/include/krb5/preauth_plugin.h \ + $(SRCTOP)/include/port-sockets.h $(SRCTOP)/include/socket-utils.h \ + srv_dec_tkt.c srv_rcache.so srv_rcache.po $(OUTPRE)srv_rcache.$(OBJEXT): \ $(BUILDTOP)/include/autoconf.h $(BUILDTOP)/include/krb5/krb5.h \ $(BUILDTOP)/include/osconf.h $(BUILDTOP)/include/profile.h \ diff --git a/src/lib/krb5/krb/srv_dec_tkt.c b/src/lib/krb5/krb/srv_dec_tkt.c new file mode 100644 index 000000000..5fce58eb4 --- /dev/null +++ b/src/lib/krb5/krb/srv_dec_tkt.c @@ -0,0 +1,93 @@ +/* + * lib/krb5/krb/srv_dec_tkt.c + * + * Copyright 2006 by the Massachusetts Institute of Technology. + * All Rights Reserved. + * + * Export of this software from the United States of America may + * require a specific license from the United States Government. + * It is the responsibility of any person or organization contemplating + * export to obtain such a license before exporting. + * + * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and + * distribute this software and its documentation for any purpose and + * without fee is hereby granted, provided that the above copyright + * notice appear in all copies and that both that copyright notice and + * this permission notice appear in supporting documentation, and that + * the name of M.I.T. not be used in advertising or publicity pertaining + * to distribution of the software without specific, written prior + * permission. Furthermore if you modify this software you must label + * your software as modified software and not distribute it in such a + * fashion that it might be confused with the original M.I.T. software. + * M.I.T. makes no representations about the suitability of + * this software for any purpose. It is provided "as is" without express + * or implied warranty. + * + * + * Server decrypt ticket via keytab or keyblock. + * + * Different from krb5_rd_req_decoded. (krb5/src/lib/krb5/krb/rd_req_dec.c) + * - No krb5_principal_compare or KRB5KRB_AP_ERR_BADMATCH error. + * - No replay cache processing. + * - No skew checking or KRB5KRB_AP_ERR_SKEW error. + * - No address checking or KRB5KRB_AP_ERR_BADADDR error. + * - No time validation. + * - No permitted enctype validation or KRB5_NOPERM_ETYPE error. + * - Does not free ticket->enc_part2 on error. + */ + +#include + +krb5_error_code KRB5_CALLCONV +krb5_server_decrypt_ticket_keyblock(krb5_context context, + const krb5_keyblock *key, + krb5_ticket *ticket) +{ + krb5_error_code retval; + krb5_data *realm; + krb5_transited *trans; + + retval = krb5_decrypt_tkt_part(context, key, ticket); + if (retval) + goto done; + + trans = &ticket->enc_part2->transited; + realm = &ticket->enc_part2->client->realm; + if (trans->tr_contents.data && *trans->tr_contents.data) { + retval = krb5_check_transited_list(context, &trans->tr_contents, + realm, &ticket->server->realm); + goto done; + } + + if (ticket->enc_part2->flags & TKT_FLG_INVALID) { /* ie, KDC_OPT_POSTDATED */ + retval = KRB5KRB_AP_ERR_TKT_INVALID; + goto done; + } + + done: + return retval; +} + + +krb5_error_code KRB5_CALLCONV +krb5_server_decrypt_ticket_keytab(krb5_context context, + const krb5_keytab kt, + krb5_ticket *ticket) +{ + krb5_error_code retval; + krb5_enctype enctype; + krb5_keytab_entry ktent; + + enctype = ticket->enc_part.enctype; + + if ((retval = krb5_kt_get_entry(context, kt, ticket->server, + ticket->enc_part.kvno, + enctype, &ktent))) + return retval; + + retval = krb5_server_decrypt_ticket_keyblock(context, &ktent.key, ticket); + /* Upon error, Free keytab entry first, then return */ + + (void) krb5_kt_free_entry(context, &ktent); + return retval; +} diff --git a/src/lib/krb5/libkrb5.exports b/src/lib/krb5/libkrb5.exports index 702cf4a2c..8446e5209 100644 --- a/src/lib/krb5/libkrb5.exports +++ b/src/lib/krb5/libkrb5.exports @@ -614,6 +614,7 @@ krb5_ser_rcache_init krb5_ser_unpack_bytes krb5_ser_unpack_int32 krb5_ser_unpack_int64 +krb5_server_decrypt_ticket_keytab krb5_set_config_files krb5_set_debugging_time krb5_set_default_in_tkt_ktypes diff --git a/src/lib/krb5_32.def b/src/lib/krb5_32.def index f767c6de1..078b8cae9 100644 --- a/src/lib/krb5_32.def +++ b/src/lib/krb5_32.def @@ -219,6 +219,7 @@ krb5_c_string_to_key_with_params krb5_recvauth_version krb5_salttype_to_string krb5_sendauth + krb5_server_decrypt_ticket_keytab krb5_set_default_realm krb5_set_default_tgs_enctypes krb5_set_password -- cgit