diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/include/pkinit_apple_utils.h | 4 | ||||
-rw-r--r-- | src/kdc/do_tgs_req.c | 30 | ||||
-rw-r--r-- | src/kdc/fast_util.c | 4 | ||||
-rw-r--r-- | src/kdc/kdc_authdata.c | 101 | ||||
-rw-r--r-- | src/kdc/kdc_preauth.c | 44 | ||||
-rw-r--r-- | src/kdc/kdc_util.h | 42 | ||||
-rw-r--r-- | src/kdc/main.c | 10 | ||||
-rw-r--r-- | src/lib/crypto/krb/keyhash_provider/keyhash_provider.h | 1 |
8 files changed, 117 insertions, 119 deletions
diff --git a/src/include/pkinit_apple_utils.h b/src/include/pkinit_apple_utils.h index 1175109..421da20 100644 --- a/src/include/pkinit_apple_utils.h +++ b/src/include/pkinit_apple_utils.h @@ -114,11 +114,11 @@ krb5_error_code pkiCfDataToKrb5Data( */ #define PKI_CSSM_TO_KRB_DATA(cd, kd) \ (kd)->data = (char *)(cd)->Data; \ - (kd)->length = (cd)->Length; + (kd)->length = (cd)->Length; #define PKI_KRB_TO_CSSM_DATA(kd, cd) \ (cd)->Data = (uint8 *)(kd)->data; \ - (cd)->Length = (kd)->length; + (cd)->Length = (kd)->length; /* * Compare to CSSM_DATAs. Return TRUE if they're the same else FALSE. diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c index dab1513..778a3e8 100644 --- a/src/kdc/do_tgs_req.c +++ b/src/kdc/do_tgs_req.c @@ -380,12 +380,12 @@ tgt_again: if (isflagset(request->kdc_options, KDC_OPT_CNAME_IN_ADDL_TKT)) { /* Do constrained delegation protocol and authorization checks */ errcode = kdc_process_s4u2proxy_req(kdc_context, - request, - request->second_ticket[st_idx]->enc_part2, - &st_client, - header_ticket->enc_part2->client, - request->server, - &status); + request, + request->second_ticket[st_idx]->enc_part2, + &st_client, + header_ticket->enc_part2->client, + request->server, + &status); if (errcode) goto cleanup; @@ -648,7 +648,7 @@ tgt_again: /* try refreshing master key list */ /* XXX it would nice if we had the mkvno here for optimization */ if (krb5_db_fetch_mkey_list(kdc_context, master_princ, - &master_keyblock, 0, &tmp_mkey_list) == 0) { + &master_keyblock, 0, &tmp_mkey_list) == 0) { krb5_dbe_free_key_list(kdc_context, master_keylist); master_keylist = tmp_mkey_list; if ((errcode = krb5_dbe_find_mkey(kdc_context, master_keylist, @@ -816,9 +816,9 @@ tgt_again: char *tdots; errcode = kdc_check_transited_list (kdc_context, - &enc_tkt_reply.transited.tr_contents, - krb5_princ_realm (kdc_context, header_enc_tkt->client), - krb5_princ_realm (kdc_context, request->server)); + &enc_tkt_reply.transited.tr_contents, + krb5_princ_realm (kdc_context, header_enc_tkt->client), + krb5_princ_realm (kdc_context, request->server)); tlen = enc_tkt_reply.transited.tr_contents.length; tdots = tlen > 125 ? "..." : ""; tlen = tlen > 125 ? 125 : tlen; @@ -943,13 +943,13 @@ tgt_again: reply.enc_part.enctype = subkey ? subkey->enctype : header_ticket->enc_part2->session->enctype; errcode = kdc_fast_response_handle_padata(state, request, &reply, - subkey ? subkey->enctype : header_ticket->enc_part2->session->enctype); + subkey ? subkey->enctype : header_ticket->enc_part2->session->enctype); if (errcode !=0 ) { status = "Preparing FAST padata"; goto cleanup; } errcode =kdc_fast_handle_reply_key(state, - subkey?subkey:header_ticket->enc_part2->session, &reply_key); + subkey?subkey:header_ticket->enc_part2->session, &reply_key); if (errcode) { status = "generating reply key"; goto cleanup; @@ -1116,9 +1116,9 @@ find_alternate_tgs(krb5_kdc_req *request, krb5_db_entry *server, * the principal. */ if ((retval = krb5_walk_realm_tree(kdc_context, - krb5_princ_realm(kdc_context, request->server), - krb5_princ_component(kdc_context, request->server, 1), - &plist, KRB5_REALM_BRANCH_CHAR))) + krb5_princ_realm(kdc_context, request->server), + krb5_princ_component(kdc_context, request->server, 1), + &plist, KRB5_REALM_BRANCH_CHAR))) return; /* move to the end */ diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c index 543db1d..17b8447 100644 --- a/src/kdc/fast_util.c +++ b/src/kdc/fast_util.c @@ -68,7 +68,7 @@ static krb5_error_code armor_ap_request tgs_server, ticket->server)) { krb5_set_error_message(kdc_context, KRB5KDC_ERR_SERVER_NOMATCH, - "ap-request armor for something other than the local TGS"); + "ap-request armor for something other than the local TGS"); retval = KRB5KDC_ERR_SERVER_NOMATCH; } } @@ -165,7 +165,7 @@ kdc_find_fast(krb5_kdc_req **requestptr, &state->armor_key); else { krb5_set_error_message(kdc_context, KRB5KDC_ERR_PREAUTH_FAILED, - "No armor key but FAST armored request present"); + "No armor key but FAST armored request present"); retval = KRB5KDC_ERR_PREAUTH_FAILED; } } diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c index aa55ef4..175fbec 100644 --- a/src/kdc/kdc_authdata.c +++ b/src/kdc/kdc_authdata.c @@ -47,58 +47,57 @@ static const char *objdirs[] = { LIBDIR "/krb5/plugins/authdata", NULL }; #endif /* MIT Kerberos 1.6 (V0) authdata plugin callback */ -typedef krb5_error_code (*authdata_proc_0) - (krb5_context, krb5_db_entry *client, - krb5_data *req_pkt, - krb5_kdc_req *request, - krb5_enc_tkt_part * enc_tkt_reply); +typedef krb5_error_code (*authdata_proc_0)( + krb5_context, + krb5_db_entry *client, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_enc_tkt_part * enc_tkt_reply); /* MIT Kerberos 1.8 (V2) authdata plugin callback */ -typedef krb5_error_code (*authdata_proc_2) - (krb5_context, unsigned int flags, - krb5_db_entry *client, krb5_db_entry *server, - krb5_db_entry *krbtgt, - krb5_keyblock *client_key, - krb5_keyblock *server_key, - krb5_keyblock *krbtgt_key, - krb5_data *req_pkt, - krb5_kdc_req *request, - krb5_const_principal for_user_princ, - krb5_enc_tkt_part *enc_tkt_request, - krb5_enc_tkt_part *enc_tkt_reply); -typedef krb5_error_code (*init_proc) - (krb5_context, void **); -typedef void (*fini_proc) - (krb5_context, void *); - -static krb5_error_code handle_request_authdata - (krb5_context context, - unsigned int flags, - krb5_db_entry *client, - krb5_db_entry *server, - krb5_db_entry *krbtgt, - krb5_keyblock *client_key, - krb5_keyblock *server_key, - krb5_keyblock *krbtgt_key, - krb5_data *req_pkt, - krb5_kdc_req *request, - krb5_const_principal for_user_princ, - krb5_enc_tkt_part *enc_tkt_request, - krb5_enc_tkt_part *enc_tkt_reply); - -static krb5_error_code handle_tgt_authdata - (krb5_context context, - unsigned int flags, - krb5_db_entry *client, - krb5_db_entry *server, - krb5_db_entry *krbtgt, - krb5_keyblock *client_key, - krb5_keyblock *server_key, - krb5_keyblock *krbtgt_key, - krb5_data *req_pkt, - krb5_kdc_req *request, - krb5_const_principal for_user_princ, - krb5_enc_tkt_part *enc_tkt_request, - krb5_enc_tkt_part *enc_tkt_reply); +typedef krb5_error_code (*authdata_proc_2)( + krb5_context, unsigned int flags, + krb5_db_entry *client, krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_keyblock *client_key, + krb5_keyblock *server_key, + krb5_keyblock *krbtgt_key, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_const_principal for_user_princ, + krb5_enc_tkt_part *enc_tkt_request, + krb5_enc_tkt_part *enc_tkt_reply); +typedef krb5_error_code (*init_proc)(krb5_context, void **); +typedef void (*fini_proc)(krb5_context, void *); + +static krb5_error_code handle_request_authdata( + krb5_context context, + unsigned int flags, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_keyblock *client_key, + krb5_keyblock *server_key, + krb5_keyblock *krbtgt_key, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_const_principal for_user_princ, + krb5_enc_tkt_part *enc_tkt_request, + krb5_enc_tkt_part *enc_tkt_reply); + +static krb5_error_code handle_tgt_authdata( + krb5_context context, + unsigned int flags, + krb5_db_entry *client, + krb5_db_entry *server, + krb5_db_entry *krbtgt, + krb5_keyblock *client_key, + krb5_keyblock *server_key, + krb5_keyblock *krbtgt_key, + krb5_data *req_pkt, + krb5_kdc_req *request, + krb5_const_principal for_user_princ, + krb5_enc_tkt_part *enc_tkt_request, + krb5_enc_tkt_part *enc_tkt_reply); static krb5_error_code handle_kdb_authdata(krb5_context context, unsigned int flags, diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c index f547f53..05b109b 100644 --- a/src/kdc/kdc_preauth.c +++ b/src/kdc/kdc_preauth.c @@ -500,14 +500,14 @@ load_preauth_plugins(krb5_context context) if (server_init_proc != NULL) { krb5_error_code initerr; initerr = (*server_init_proc)(context, &plugin_context, - (const char **)kdc_realm_names); + (const char **)kdc_realm_names); if (initerr) { const char *emsg; emsg = krb5_get_error_message(context, initerr); if (emsg) { krb5_klog_syslog(LOG_ERR, - "preauth %s failed to initialize: %s", - ftable->name, emsg); + "preauth %s failed to initialize: %s", + ftable->name, emsg); krb5_free_error_message(context, emsg); } memset(&preauth_systems[k], 0, @@ -521,7 +521,7 @@ load_preauth_plugins(krb5_context context) preauth_systems[k].type = ftable->pa_type_list[j]; if (ftable->flags_proc != NULL) preauth_systems[k].flags = ftable->flags_proc(context, - preauth_systems[k].type); + preauth_systems[k].type); else preauth_systems[k].flags = 0; preauth_systems[k].plugin_context = plugin_context; @@ -557,7 +557,7 @@ unload_preauth_plugins(krb5_context context) for (i = 0; i < n_preauth_systems; i++) { if (preauth_systems[i].fini != NULL) { (*preauth_systems[i].fini)(context, - preauth_systems[i].plugin_context); + preauth_systems[i].plugin_context); } memset(&preauth_systems[i], 0, sizeof(preauth_systems[i])); } @@ -952,12 +952,12 @@ const char *missing_required_preauth(krb5_db_entry *client, #ifdef DEBUG krb5_klog_syslog ( - LOG_DEBUG, - "client needs %spreauth, %shw preauth; request has %spreauth, %shw preauth", - isflagset (client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) ? "" : "no ", - isflagset (client->attributes, KRB5_KDB_REQUIRES_HW_AUTH) ? "" : "no ", - isflagset (enc_tkt_reply->flags, TKT_FLG_PRE_AUTH) ? "" : "no ", - isflagset (enc_tkt_reply->flags, TKT_FLG_HW_AUTH) ? "" : "no "); + LOG_DEBUG, + "client needs %spreauth, %shw preauth; request has %spreauth, %shw preauth", + isflagset (client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) ? "" : "no ", + isflagset (client->attributes, KRB5_KDB_REQUIRES_HW_AUTH) ? "" : "no ", + isflagset (enc_tkt_reply->flags, TKT_FLG_PRE_AUTH) ? "" : "no ", + isflagset (enc_tkt_reply->flags, TKT_FLG_HW_AUTH) ? "" : "no "); #endif if (isflagset(client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) && @@ -1370,7 +1370,7 @@ cleanup: static krb5_boolean request_contains_enctype(krb5_context context, const krb5_kdc_req *request, - krb5_enctype enctype) + krb5_enctype enctype) { int i; for (i =0; i < request->nktypes; i++) @@ -2891,15 +2891,15 @@ static krb5_error_code return_pkinit_response( * We've already verified; just obtain the fields we need to create a response */ krtn = krb5int_pkinit_as_req_parse(context, - &pa_data, - NULL, NULL, &nonce, /* ctime, cusec, nonce */ - NULL, NULL, /* pa_cksum, cert_status */ - &num_cms_types, &cms_types, - &client_cert, /* signer_cert: we encrypt for this */ - /* remaining fields unused (for now) */ - NULL, NULL, /* num_all_certs, all_certs */ - &num_trusted_CAs, &trusted_CAs, - &kdc_cert); + &pa_data, + NULL, NULL, &nonce, /* ctime, cusec, nonce */ + NULL, NULL, /* pa_cksum, cert_status */ + &num_cms_types, &cms_types, + &client_cert, /* signer_cert: we encrypt for this */ + /* remaining fields unused (for now) */ + NULL, NULL, /* num_all_certs, all_certs */ + &num_trusted_CAs, &trusted_CAs, + &kdc_cert); if(krtn) { kdcPkinitDebug("pa_pk_as_req_parse returned %d; PKINIT aborting.\n", (int)krtn); @@ -2964,7 +2964,7 @@ static krb5_error_code return_pkinit_response( &pa_data); if(krtn) { kdcPkinitDebug("pa_pk_as_rep_create returned %d; PKINIT aborting.\n", - (int)krtn); + (int)krtn); goto cleanup; } diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h index cddbaf6..a234720 100644 --- a/src/kdc/kdc_util.h +++ b/src/kdc/kdc_util.h @@ -45,14 +45,14 @@ krb5_boolean is_local_principal(krb5_const_principal princ1); krb5_boolean krb5_is_tgs_principal (krb5_const_principal); krb5_error_code add_to_transited (krb5_data *, - krb5_data *, - krb5_principal, - krb5_principal, - krb5_principal); + krb5_data *, + krb5_principal, + krb5_principal, + krb5_principal); krb5_error_code compress_transited (krb5_data *, - krb5_principal, - krb5_data *); + krb5_principal, + krb5_data *); krb5_error_code concat_authorization_data (krb5_authdata **, krb5_authdata **, @@ -127,19 +127,19 @@ rep_etypes2str(char *s, size_t len, krb5_kdc_rep *rep); /* do_as_req.c */ krb5_error_code process_as_req (krb5_kdc_req *, krb5_data *, - const krb5_fulladdr *, - krb5_data ** ); + const krb5_fulladdr *, + krb5_data ** ); /* do_tgs_req.c */ krb5_error_code process_tgs_req (krb5_data *, - const krb5_fulladdr *, - krb5_data ** ); + const krb5_fulladdr *, + krb5_data ** ); /* dispatch.c */ krb5_error_code dispatch (krb5_data *, - const krb5_fulladdr *, - krb5_data **); + const krb5_fulladdr *, + krb5_data **); /* main.c */ krb5_error_code kdc_initialize_rcache (krb5_context, char *); @@ -157,13 +157,13 @@ krb5_error_code closedown_network (void); /* policy.c */ int against_local_policy_as (krb5_kdc_req *, krb5_db_entry, - krb5_db_entry, krb5_timestamp, - const char **, krb5_data *); + krb5_db_entry, krb5_timestamp, + const char **, krb5_data *); int against_local_policy_tgs (krb5_kdc_req *, krb5_db_entry, - krb5_ticket *, const char **, - krb5_data *); + krb5_ticket *, const char **, + krb5_data *); /* kdc_preauth.c */ krb5_boolean @@ -171,13 +171,13 @@ enctype_requires_etype_info_2(krb5_enctype enctype); const char * missing_required_preauth (krb5_db_entry *client, - krb5_db_entry *server, - krb5_enc_tkt_part *enc_tkt_reply); + krb5_db_entry *server, + krb5_enc_tkt_part *enc_tkt_reply); void get_preauth_hint_list (krb5_kdc_req * request, - krb5_db_entry *client, - krb5_db_entry *server, - krb5_data *e_data); + krb5_db_entry *client, + krb5_db_entry *server, + krb5_data *e_data); krb5_error_code load_preauth_plugins(krb5_context context); krb5_error_code diff --git a/src/kdc/main.c b/src/kdc/main.c index a12a773..925019c 100644 --- a/src/kdc/main.c +++ b/src/kdc/main.c @@ -213,15 +213,15 @@ handle_referral_params(krb5_realm_params *rparams, if (!rdp->realm_no_host_referral) retval = ENOMEM; } else if (no_refrls && (asprintf(&(rdp->realm_no_host_referral), - "%s%s%s%s%s", " ", no_refrls," ", - rparams->realm_no_host_referral, " ") < 0)) + "%s%s%s%s%s", " ", no_refrls," ", + rparams->realm_no_host_referral, " ") < 0)) retval = ENOMEM; else if (asprintf(&(rdp->realm_no_host_referral),"%s%s%s", " ", rparams->realm_no_host_referral, " ") < 0) retval = ENOMEM; } else if( no_refrls != NULL) { if ( asprintf(&(rdp->realm_no_host_referral), - "%s%s%s", " ", no_refrls, " ") < 0) + "%s%s%s", " ", no_refrls, " ") < 0) retval = ENOMEM; } else rdp->realm_no_host_referral = NULL; @@ -235,7 +235,7 @@ handle_referral_params(krb5_realm_params *rparams, } if (host_based_srvcs && - (krb5_match_config_pattern(host_based_srvcs, KRB5_CONF_ASTERISK) == TRUE)) { + (krb5_match_config_pattern(host_based_srvcs, KRB5_CONF_ASTERISK) == TRUE)) { rdp->realm_host_based_services = strdup(KRB5_CONF_ASTERISK); if (!rdp->realm_host_based_services) retval = ENOMEM; @@ -661,7 +661,7 @@ initialize_realms(krb5_context kcontext, int argc, char **argv) default_tcp_ports, manual, db_args, no_refrls, host_based_srvcs))) { fprintf(stderr, - "%s: cannot initialize realm %s - see log file for details\n", + "%s: cannot initialize realm %s - see log file for details\n", argv[0], optarg); exit(1); } diff --git a/src/lib/crypto/krb/keyhash_provider/keyhash_provider.h b/src/lib/crypto/krb/keyhash_provider/keyhash_provider.h index 2506dc3..c16f0fc 100644 --- a/src/lib/crypto/krb/keyhash_provider/keyhash_provider.h +++ b/src/lib/crypto/krb/keyhash_provider/keyhash_provider.h @@ -31,4 +31,3 @@ extern const struct krb5_keyhash_provider krb5int_keyhash_md4des; extern const struct krb5_keyhash_provider krb5int_keyhash_md5des; extern const struct krb5_keyhash_provider krb5int_keyhash_hmac_md5; extern const struct krb5_keyhash_provider krb5int_keyhash_md5_hmac; - |