kauth: Move COUNT_REQ to beginning of block

[openafs.git] / src / kauth / kaprocs.c

diff --git a/src/kauth/kaprocs.c b/src/kauth/kaprocs.c
index 71a834d..f7c639e 100644 (file)
--- a/src/kauth/kaprocs.c
+++ b/src/kauth/kaprocs.c
@@ -33,6 +33,7 @@
 #include <rx/xdr.h>
 #include <rx/rx.h>
 #include <rx/rxkad.h>
+#include <rx/rxkad_convert.h>
 #include <afs/cellconfig.h>
 #include <afs/auth.h>
 #include <afs/com_err.h>
@@ -370,13 +371,13 @@ check_auth(struct rx_call *call,
        noAuthenticationRequired = afsconf_GetNoAuthFlag(KA_conf);
 
     si = rx_SecurityClassOf(rx_ConnectionOf(call));
-    if (si == RX_SCINDEX_VAB) {
+    if (si == RX_SECIDX_VAB) {
        printf("No support for VAB security module yet.\n");
        return -1;
-    } else if (si == RX_SCINDEX_NULL) {
+    } else if (si == RX_SECIDX_NULL) {
        code = KANOAUTH;
        goto no_auth;
-    } else if (si != RX_SCINDEX_KAD) {
+    } else if (si != RX_SECIDX_KAD) {
        es_Report("Unknown security index %d\n", si);
        return -1;
     }
@@ -648,7 +649,7 @@ kamCreateUser(struct rx_call *call, char *aname, char *ainstance,
     }
     code = ubik_EndTrans(tt);
     KALOG(aname, ainstance, NULL, NULL, NULL,
-         rx_PeerOf(rx_ConnectionOf(call))->host, LOG_CRUSER);
+         rx_HostOf(rx_PeerOf(rx_ConnectionOf(call))), LOG_CRUSER);
     return code;
 }
 
@@ -710,7 +711,9 @@ ChangePassWord(struct rx_call *call, char *aname, char *ainstance,
     /* validate the request */
     request_time = ntohl(request.time);        /* reorder date */
     kvno = ntohl(request.kvno);
-    if ((abs(request_time - time(0)) > KTC_TIME_UNCERTAINTY) || strncmp(request.label, KA_CPW_REQ_LABEL, sizeof(request.label)) || (request.spare) || (kvno > MAXKAKVNO)) {    /* these are reseved */
+    if (check_ka_skew(request_time, time(NULL), KTC_TIME_UNCERTAINTY) ||
+       strncmp(request.label, KA_CPW_REQ_LABEL, sizeof(request.label)) ||
+       request.spare || kvno > MAXKAKVNO) {    /* these are reserved */
        code = KABADREQUEST;
        goto abort;
     }
@@ -924,7 +927,7 @@ kamSetPassword(struct rx_call *call, char *aname, char *ainstance,
 
     code = ubik_EndTrans(tt);
     KALOG(aname, ainstance, NULL, NULL, NULL,
-         rx_PeerOf(rx_ConnectionOf(call))->host, LOG_CHPASSWD);
+         rx_HostOf(rx_PeerOf(rx_ConnectionOf(call))), LOG_CHPASSWD);
     return code;
 
   abort:
@@ -1140,16 +1143,7 @@ Authenticate(int version, struct rx_call *call, char *aname, char *ainstance,
     }
 #endif /* EXPIREPW */
 
-    if (abs(request.time - now) > KTC_TIME_UNCERTAINTY) {
-#if 0
-       if (oanswer->MaxSeqLen < sizeof(afs_int32))
-           code = KAANSWERTOOLONG;
-       else {                  /* return our time if possible */
-           oanswer->SeqLen = sizeof(afs_int32);
-           request.time = htonl(now);
-           memcpy(oanswer->SeqBody, &request.time, sizeof(afs_int32));
-       }
-#endif
+    if (check_ka_skew(request.time, now, KTC_TIME_UNCERTAINTY)) {
        code = KACLOCKSKEW;
        goto abort;
     }
@@ -1247,14 +1241,14 @@ Authenticate(int version, struct rx_call *call, char *aname, char *ainstance,
                     &user_schedule, ktc_to_cblockptr(&tentry.key), ENCRYPT);
     code = ubik_EndTrans(tt);
     KALOG(aname, ainstance, sname, sinst, NULL,
-         rx_PeerOf(rx_ConnectionOf(call))->host, LOG_AUTHENTICATE);
+         rx_HostOf(rx_PeerOf(rx_ConnectionOf(call))), LOG_AUTHENTICATE);
     return code;
 
   abort:
     COUNT_ABO;
     ubik_AbortTrans(tt);
     KALOG(aname, ainstance, sname, sinst, NULL,
-         rx_PeerOf(rx_ConnectionOf(call))->host, LOG_AUTHFAILED);
+         rx_HostOf(rx_PeerOf(rx_ConnectionOf(call))), LOG_AUTHFAILED);
     return code;
 }
 
@@ -1456,7 +1450,7 @@ kamSetFields(struct rx_call *call,
 
     code = ubik_EndTrans(tt);
     KALOG(aname, ainstance, NULL, NULL, NULL,
-         rx_PeerOf(rx_ConnectionOf(call))->host, LOG_SETFIELDS);
+         rx_HostOf(rx_PeerOf(rx_ConnectionOf(call))), LOG_SETFIELDS);
     return code;
 
   abort:
@@ -1529,7 +1523,7 @@ kamDeleteUser(struct rx_call *call, char *aname, char *ainstance)
 
     code = ubik_EndTrans(tt);
     KALOG(aname, ainstance, NULL, NULL, NULL,
-         rx_PeerOf(rx_ConnectionOf(call))->host, LOG_DELUSER);
+         rx_HostOf(rx_PeerOf(rx_ConnectionOf(call))), LOG_DELUSER);
     return code;
 }
 
@@ -1637,7 +1631,11 @@ kamGetEntry(struct rx_call *call,
        memcpy(&aentry->key, &tentry.key, sizeof(struct ktc_encryptionKey));
     else
        memset(&aentry->key, 0, sizeof(aentry->key));
+
     code = ka_KeyCheckSum((char *)&tentry.key, &aentry->keyCheckSum);
+    if (code)
+       goto abort;
+
     if (!tentry.pwsums[0] && npwSums > 1 && !tentry.pwsums[1]) {
        aentry->reserved3 = 0x12340000;
     } else {
@@ -1694,6 +1692,7 @@ kamListEntry(struct rx_call *call,
     struct kaentry tentry;
 
     COUNT_REQ(ListEntry);
+    memset(name, 0, sizeof(*name));
     if ((code = InitAuthServ(&tt, LOCKREAD, this_op)))
        return code;
     code = check_auth(call, tt, 1, &caller);
@@ -1932,7 +1931,7 @@ GetTicket(int version,
                     &schedule, ktc_to_cblockptr(&authSessionKey), ENCRYPT);
     code = ubik_EndTrans(tt);
     KALOG(name, instance, sname, sinstance, (import ? authDomain : NULL),
-         rx_PeerOf(rx_ConnectionOf(call))->host, LOG_GETTICKET);
+         rx_HostOf(rx_PeerOf(rx_ConnectionOf(call))), LOG_GETTICKET);
     return code;
 
   abort:
@@ -2259,7 +2258,7 @@ SKAM_Unlock(struct rx_call *call,
 
     code = ubik_EndTrans(tt);
     KALOG(aname, ainstance, NULL, NULL, NULL,
-         rx_PeerOf(rx_ConnectionOf(call))->host, LOG_UNLOCK);
+         rx_HostOf(rx_PeerOf(rx_ConnectionOf(call))), LOG_UNLOCK);
     goto exit;
 
   abort: