auth-krb: Move pac related util functions in a single place.

Signed-off-by: Andreas Schneider <asn@samba.org>

diff --git a/auth/kerberos/gssapi_pac.c b/auth/kerberos/gssapi_pac.c
index 07c7c9420561f6a9d5f0b590da38769cb002e353..05065b2725ba3a091a6606bcb1a53bca4302ba13 100644 (file)
--- a/auth/kerberos/gssapi_pac.c
+++ b/auth/kerberos/gssapi_pac.c
@@ -22,6 +22,7 @@
 #ifdef HAVE_KRB5
 
 #include "libcli/auth/krb5_wrap.h"
+#include "auth/kerberos/pac_utils.h"
 
 #if 0
 /* FIXME - need proper configure/waf test

diff --git a/auth/kerberos/kerberos_pac.c b/auth/kerberos/kerberos_pac.c
index 5155c9fd289847bb4a14ab77681b34c75fcdb4fd..eacf39d321ea04c59d25655bfc3fa4f339747a6b 100644 (file)
--- a/auth/kerberos/kerberos_pac.c
+++ b/auth/kerberos/kerberos_pac.c
@@ -26,7 +26,7 @@
 #ifdef HAVE_KRB5
 
 #include "librpc/gen_ndr/ndr_krb5pac.h"
-#include "libcli/auth/krb5_wrap.h"
+#include "auth/kerberos/pac_utils.h"
 
 krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
                                          struct PAC_SIGNATURE_DATA *sig,
@@ -36,8 +36,18 @@ krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
        krb5_error_code ret;
        krb5_checksum cksum;
        krb5_keyusage usage = 0;
-
-       smb_krb5_checksum_from_pac_sig(&cksum, sig);
+       krb5_boolean checksum_valid = false;
+       krb5_data input;
+
+#ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM /* Heimdal */
+       cksum.cksumtype = (krb5_cksumtype)sig->type;
+       cksum.checksum.length   = sig->signature.length;
+       cksum.checksum.data     = sig->signature.data;
+#else /* MIT */
+       cksum.checksum_type     = (krb5_cksumtype)sig->type;
+       cksum.length            = sig->signature.length;
+       cksum.contents          = sig->signature.data;
+#endif
 
 #ifdef HAVE_KRB5_KU_OTHER_CKSUM /* Heimdal */
        usage = KRB5_KU_OTHER_CKSUM;
@@ -47,14 +57,19 @@ krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
 #error UNKNOWN_KRB5_KEYUSAGE
 #endif
 
-       ret = smb_krb5_verify_checksum(context,
-                                      keyblock,
-                                      usage,
-                                      &cksum,
-                                      pac_data.data,
-                                      pac_data.length);
-
-       if (ret) {
+       input.data = (char *)pac_data.data;
+       input.length = pac_data.length;
+
+       ret = krb5_c_verify_checksum(context,
+                                    keyblock,
+                                    usage,
+                                    &input,
+                                    &cksum,
+                                    &checksum_valid);
+       if (!checksum_valid) {
+               ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+       }
+       if (ret){
                DEBUG(2,("check_pac_checksum: PAC Verification failed: %s (%d)\n",
                        error_message(ret), ret));
                return ret;

diff --git a/auth/kerberos/pac_utils.h b/auth/kerberos/pac_utils.h
new file mode 100644 (file)
index 0000000..9fe08de
--- /dev/null
+++ b/auth/kerberos/pac_utils.h
@@ -0,0 +1,50 @@
+/*
+   Unix SMB/CIFS implementation.
+   kerberos authorization data (PAC) utility library
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2011
+   Copyright (C) Simo Sorce 2010-2012
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _PAC_UTILS_H
+#define _PAC_UTILS_H
+
+#include "libcli/auth/krb5_wrap.h"
+struct PAC_SIGNATURE_DATA;
+struct PAC_DATA;
+
+krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
+                                  struct PAC_SIGNATURE_DATA *sig,
+                                  krb5_context context,
+                                  const krb5_keyblock *keyblock);
+
+NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
+                            DATA_BLOB pac_data_blob,
+                            krb5_context context,
+                            const krb5_keyblock *krbtgt_keyblock,
+                            const krb5_keyblock *service_keyblock,
+                            krb5_const_principal client_principal,
+                            time_t tgs_authtime,
+                            struct PAC_DATA **pac_data_out);
+
+NTSTATUS gssapi_obtain_pac_blob(TALLOC_CTX *mem_ctx,
+                               gss_ctx_id_t gssapi_context,
+                               gss_name_t gss_client_name,
+                               DATA_BLOB *pac_data);
+NTSTATUS gssapi_get_session_key(TALLOC_CTX *mem_ctx,
+                               gss_ctx_id_t gssapi_context,
+                               DATA_BLOB *session_key,
+                               uint32_t *keytype);
+#endif /* _PAC_UTILS_H */

diff --git a/auth/kerberos/wscript_build b/auth/kerberos/wscript_build
old mode 100644 (file)
new mode 100755 (executable)
index 2421b16..f49cc51
--- a/auth/kerberos/wscript_build
+++ b/auth/kerberos/wscript_build
@@ -1,3 +1,4 @@
+#!/usr/bin/env python
 bld.SAMBA_SUBSYSTEM('KRB5_PAC',
                     source='gssapi_pac.c kerberos_pac.c',
                     deps='gssapi_krb5 krb5 ndr-krb5pac com_err')

diff --git a/libcli/auth/krb5_wrap.c b/libcli/auth/krb5_wrap.c
index c16b35dceea9f83300f6a9c91338615bcea38b60..2f877e7f0a87fe68be91f9c6eee716cdec1b8cfe 100644 (file)
--- a/libcli/auth/krb5_wrap.c
+++ b/libcli/auth/krb5_wrap.c
@@ -186,55 +186,6 @@ krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
        return krb5_principal_compare_any_realm(context, princ1, princ2);
 }
 
- void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
-                                    struct PAC_SIGNATURE_DATA *sig)
-{
-#ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM
-       cksum->cksumtype        = (krb5_cksumtype)sig->type;
-       cksum->checksum.length  = sig->signature.length;
-       cksum->checksum.data    = sig->signature.data;
-#else
-       cksum->checksum_type    = (krb5_cksumtype)sig->type;
-       cksum->length           = sig->signature.length;
-       cksum->contents         = sig->signature.data;
-#endif
-}
-
- krb5_error_code smb_krb5_verify_checksum(krb5_context context,
-                                         const krb5_keyblock *keyblock,
-                                        krb5_keyusage usage,
-                                        krb5_checksum *cksum,
-                                        uint8_t *data,
-                                        size_t length)
-{
-       krb5_error_code ret;
-
-       /* verify the checksum, heimdal 0.7 and MIT krb 1.4.2 and above */
-
-       krb5_boolean checksum_valid = false;
-       krb5_data input;
-       
-       input.data = (char *)data;
-       input.length = length;
-       
-       ret = krb5_c_verify_checksum(context, 
-                                    keyblock, 
-                                    usage,
-                                    &input, 
-                                    cksum,
-                                    &checksum_valid);
-       if (ret) {
-               DEBUG(3,("smb_krb5_verify_checksum: krb5_c_verify_checksum() failed: %s\n", 
-                        error_message(ret)));
-               return ret;
-       }
-       
-       if (!checksum_valid)
-               ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
-
-       return ret;
-}
-
 char *gssapi_error_string(TALLOC_CTX *mem_ctx, 
                          OM_uint32 maj_stat, OM_uint32 min_stat, 
                          const gss_OID mech)

diff --git a/libcli/auth/krb5_wrap.h b/libcli/auth/krb5_wrap.h
index 8723d2ddaa5a9136adfe97942bd23ba1291091d4..4c0ef93e4c90a9a190354435706c541bc496a5df 100644 (file)
--- a/libcli/auth/krb5_wrap.h
+++ b/libcli/auth/krb5_wrap.h
@@ -21,8 +21,6 @@
 */
 
 #include "system/kerberos.h"
-struct PAC_SIGNATURE_DATA;
-struct PAC_DATA;
 
 #ifdef HAVE_KRB5_KEYBLOCK_KEYVALUE /* Heimdal */
 #define KRB5_KEY_TYPE(k)       ((k)->keytype)
@@ -57,38 +55,8 @@ krb5_error_code smb_krb5_unparse_name(TALLOC_CTX *mem_ctx,
  bool smb_krb5_principal_compare_any_realm(krb5_context context, 
                                          krb5_const_principal princ1, 
                                           krb5_const_principal princ2);
- void smb_krb5_checksum_from_pac_sig(krb5_checksum *cksum,
-                                    struct PAC_SIGNATURE_DATA *sig);
- krb5_error_code smb_krb5_verify_checksum(krb5_context context,
-                                         const krb5_keyblock *keyblock,
-                                        krb5_keyusage usage,
-                                        krb5_checksum *cksum,
-                                        uint8_t *data,
-                                         size_t length);
 char *gssapi_error_string(TALLOC_CTX *mem_ctx, 
                          OM_uint32 maj_stat, OM_uint32 min_stat, 
                          const gss_OID mech);
 char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx);
 
-krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
-                                  struct PAC_SIGNATURE_DATA *sig,
-                                  krb5_context context,
-                                  const krb5_keyblock *keyblock);
-
-NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
-                            DATA_BLOB pac_data_blob,
-                            krb5_context context,
-                            const krb5_keyblock *krbtgt_keyblock,
-                            const krb5_keyblock *service_keyblock,
-                            krb5_const_principal client_principal,
-                            time_t tgs_authtime,
-                            struct PAC_DATA **pac_data_out);
-
-NTSTATUS gssapi_obtain_pac_blob(TALLOC_CTX *mem_ctx,
-                               gss_ctx_id_t gssapi_context,
-                               gss_name_t gss_client_name,
-                               DATA_BLOB *pac_data);
-NTSTATUS gssapi_get_session_key(TALLOC_CTX *mem_ctx,
-                               gss_ctx_id_t gssapi_context,
-                               DATA_BLOB *session_key, 
-                               uint32_t *keytype);

diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
index c37672620f46eef0256d84d0e376fb4dbb77c5db..9b9e96e89b35f9cbf809bdfb9b74e99e52e23e9f 100644 (file)
--- a/source3/auth/auth_generic.c
+++ b/source3/auth/auth_generic.c
@@ -27,7 +27,7 @@
 #include "auth/gensec/gensec.h"
 #include "lib/param/param.h"
 #ifdef HAVE_KRB5
-#include "libcli/auth/krb5_wrap.h"
+#include "auth/kerberos/pac_utils.h"
 #endif
 #include "librpc/crypto/gse.h"
 #include "auth/credentials/credentials.h"

diff --git a/source3/include/smb_krb5.h b/source3/include/smb_krb5.h
index 152652512d93356ab3770a85e9c6863b5b0ab6ff..88e91e1670b9bf0f9032551f09cf6e5b154c99e5 100644 (file)
--- a/source3/include/smb_krb5.h
+++ b/source3/include/smb_krb5.h
@@ -35,6 +35,7 @@
 #endif
 
 #include "libcli/auth/krb5_wrap.h"
+#include "auth/kerberos/pac_utils.h"
 
 #ifndef KRB5_ADDR_NETBIOS
 #define KRB5_ADDR_NETBIOS 0x14

diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index c6d4fb5fd58fbe96735e7a70878cff8494d5f22d..7de15c8673c319747d128ea9637f7143e6b2b3dc 100644 (file)
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -42,6 +42,7 @@
 #include <gssapi/gssapi_spnego.h>
 #include "gensec_gssapi.h"
 #include "lib/util/util_net.h"
+#include "auth/kerberos/pac_utils.h"
 
 _PUBLIC_ NTSTATUS gensec_gssapi_init(void);
 

diff --git a/source4/auth/gensec/gensec_krb5.c b/source4/auth/gensec/gensec_krb5.c
index ca933f5b0fec52b207164b322ca505a74a0a994f..8dde8373a8e45cbc850b1da78f74cd501aa0a04c 100644 (file)
--- a/source4/auth/gensec/gensec_krb5.c
+++ b/source4/auth/gensec/gensec_krb5.c
@@ -40,6 +40,7 @@
 #include "auth/auth_sam_reply.h"
 #include "lib/util/util_net.h"
 #include "../lib/util/asn1.h"
+#include "auth/kerberos/pac_utils.h"
 
 _PUBLIC_ NTSTATUS gensec_krb5_init(void);
 

diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index 2e60af6f84622183f724ca0469138368221d33e5..82a029871c6897087664f3c75720e764a7a527b0 100644 (file)
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -31,6 +31,7 @@
 #include <ldb.h>
 #include "auth/auth_sam_reply.h"
 #include "auth/kerberos/kerberos_util.h"
+#include "auth/kerberos/pac_utils.h"
 
 _PUBLIC_  NTSTATUS kerberos_pac_logon_info(TALLOC_CTX *mem_ctx,
                                           DATA_BLOB blob,

diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 3b0f00f850352ba0fc4fcc9b7711f9052efa5b07..d654dc32cae63493be35ecfab53e9dabe072f528 100644 (file)
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -32,6 +32,7 @@
 #include "librpc/gen_ndr/ndr_krb5pac.h"
 #include "libcli/security/security.h"
 #include "dsdb/samdb/samdb.h"
+#include "auth/kerberos/pac_utils.h"
 
 static
 NTSTATUS samba_get_logon_info_pac_blob(TALLOC_CTX *mem_ctx,

diff --git a/source4/torture/auth/pac.c b/source4/torture/auth/pac.c
index 4840a79b7fd835c874d81013e90870e1f1c164c8..827864242cb8d0b5e76dc963197a8e19b9fd8555 100644 (file)
--- a/source4/torture/auth/pac.c
+++ b/source4/torture/auth/pac.c
@@ -31,6 +31,7 @@
 #include "param/param.h"
 #include "librpc/gen_ndr/ndr_krb5pac.h"
 #include "torture/auth/proto.h"
+#include "auth/kerberos/pac_utils.h"
 
 static bool torture_pac_self_check(struct torture_context *tctx)
 {