#error "Must have either keyblock or session member of krb5_creds"
#endif
-#ifdef AFS_DARWIN110_ENV
-#define HAVE_NO_KRB5_524 /* MITKerberosShim logs but returns success */
+/* MITKerberosShim logs but returns success */
+#if !defined(HAVE_KRB5_524_CONV_PRINCIPAL) || defined(AFS_DARWIN110_ENV) || (!defined(HAVE_KRB5_524_CONVERT_CREDS) && !defined(HAVE_KRB524_CONVERT_CREDS_KDC))
+#define HAVE_NO_KRB5_524
#elif !defined(HAVE_KRB5_524_CONVERT_CREDS) && defined(HAVE_KRB524_CONVERT_CREDS_KDC)
#define krb5_524_convert_creds krb524_convert_creds_kdc
-#elif !defined(HAVE_KRB5_524_CONVERT_CREDS) && !defined(HAVE_KRB524_CONVERT_CREDS_KDC)
-#define HAVE_NO_KRB5_524
#endif
#if USING_HEIMDAL
krb5_svc_get_msg(code,&str);
#elif defined(HAVE_ERROR_MESSAGE)
str = error_message(code);
-#elif defined(KRB5_PROG_ETYPE_NOSUPP) && !(defined(HAVE_KRB5_ENCTYPE_ENABLE) || defined(HAVE_KRB5_ALLOW_WEAK_CRYPTO))
- /* Lion gives us nothing to hook here and no weak crypto switch */
- if (code == KRB5_PROG_ETYPE_NOSUPP)
- str = "encryption type not supported; \"allow_weak_crypto = true\" needed in Kerberos configuration";
#else
; /* IRIX apparently has neither: use the string we have */
#endif
{
cellinfo_t *new_cellinfo;
- if ((new_cellinfo = (cellinfo_t *)malloc(sizeof(cellinfo_t))))
+ if ((new_cellinfo = malloc(sizeof(cellinfo_t))))
memcpy(new_cellinfo, cellinfo, sizeof(cellinfo_t));
return ((char *)new_cellinfo);
rxkad_build_native_token(krb5_context context, krb5_creds *v5cred,
struct ktc_tokenUnion **tokenPtr, char **userPtr) {
char username[BUFSIZ];
- struct ktc_tokenUnion *token;
- struct token_rxkad *rxkadToken;
+ struct ktc_token token;
+ int status;
#ifdef HAVE_NO_KRB5_524
char *p;
int len;
#else
- int status;
char k4name[ANAME_SZ];
char k4inst[INST_SZ];
char k4realm[REALM_SZ];
}
#endif
- token = malloc(sizeof(struct ktc_tokenUnion));
- if (token == NULL)
- return ENOMEM;
-
- memset(token, 0, sizeof(struct ktc_tokenUnion));
-
- token->at_type = AFSTOKEN_UNION_KAD;
- rxkadToken = &token->ktc_tokenUnion_u.at_kad;
+ memset(&token, 0, sizeof(struct ktc_token));
- rxkadToken->rk_kvno = RXKAD_TKT_TYPE_KERBEROS_V5;
- rxkadToken->rk_begintime = v5cred->times.starttime;;
- rxkadToken->rk_endtime = v5cred->times.endtime;
- memcpy(&rxkadToken->rk_key, get_cred_keydata(v5cred),
+ token.kvno = RXKAD_TKT_TYPE_KERBEROS_V5;
+ token.startTime = v5cred->times.starttime;;
+ token.endTime = v5cred->times.endtime;
+ memcpy(&token.sessionKey, get_cred_keydata(v5cred),
get_cred_keylen(v5cred));
- rxkadToken->rk_ticket.rk_ticket_len = v5cred->ticket.length;
- rxkadToken->rk_ticket.rk_ticket_val = malloc(v5cred->ticket.length);
- if (rxkadToken->rk_ticket.rk_ticket_val == NULL) {
- free(token);
- return ENOMEM;
+ token.ticketLen = v5cred->ticket.length;
+ memcpy(token.ticket, v5cred->ticket.data, token.ticketLen);
+
+ status = token_importRxkadViceId(tokenPtr, &token, 0);
+ if (status) {
+ return status;
}
- memcpy(rxkadToken->rk_ticket.rk_ticket_val, v5cred->ticket.data,
- rxkadToken->rk_ticket.rk_ticket_len);
- *tokenPtr = token;
*userPtr = strdup(username);
return 0;
struct ktc_tokenUnion **tokenPtr, char **userPtr) {
CREDENTIALS cred;
char username[BUFSIZ];
- struct ktc_tokenUnion *token;
- struct token_rxkad *rxkadToken;
+ struct ktc_token token;
int status;
*tokenPtr = NULL;
strcat (username, cred.pinst);
}
- token = malloc(sizeof(struct ktc_tokenUnion));
- if (token == NULL)
- return ENOMEM;
- memset(token, 0, sizeof(struct ktc_tokenUnion));
-
- token->at_type = AFSTOKEN_UNION_KAD;
+ memset(&token, 0, sizeof(struct ktc_token));
- rxkadToken = &token->ktc_tokenUnion_u.at_kad;
- rxkadToken->rk_kvno = cred.kvno;
- rxkadToken->rk_begintime = cred.issue_date;
+ token.kvno = cred.kvno;
+ token.startTime = cred.issue_date;
/*
* It seems silly to go through a bunch of contortions to
* extract the expiration time, when the v5 credentials already
* Note that this isn't a security hole, as the expiration time
* is also contained in the encrypted token
*/
- rxkadToken->rk_endtime = v5cred->times.endtime;
- memcpy(&rxkadToken->rk_key, cred.session, 8);
- rxkadToken->rk_ticket.rk_ticket_len = cred.ticket_st.length;
- rxkadToken->rk_ticket.rk_ticket_val = malloc(cred.ticket_st.length);
- if (rxkadToken->rk_ticket.rk_ticket_val == NULL) {
- free(token);
- return ENOMEM;
+ token.endTime = v5cred->times.endtime;
+ memcpy(&token.sessionKey, cred.session, 8);
+ token.ticketLen = cred.ticket_st.length;
+ memcpy(token.ticket, cred.ticket_st.dat, token.ticketLen);
+
+ status = token_importRxkadViceId(tokenPtr, &token, 0);
+ if (status) {
+ return status;
}
- memcpy(rxkadToken->rk_ticket.rk_ticket_val, cred.ticket_st.dat,
- rxkadToken->rk_ticket.rk_ticket_len);
- *tokenPtr = token;
*userPtr = strdup(username);
return 0;
char *realmUsed = NULL;
char *username = NULL;
int status;
- size_t len;
*token = NULL;
*authuser = NULL;
username = NULL;
*foreign = 0;
} else {
- len = strlen(username)+strlen(realmUsed)+2;
- *authuser = malloc(len);
- snprintf(*authuser, len, "%s@%s", username, realmUsed);
+ asprintf(authuser, "%s@%s", username, realmUsed);
*foreign = 1;
}
#endif /* ALLOW_REGISTER */
if ((status == 0) && (viceId != ANONYMOUSID)) {
- rxkadToken->ktc_tokenUnion_u.at_kad.rk_viceid = viceId;
- token_replaceToken(token, rxkadToken);
+ status = token_setRxkadViceId(rxkadToken, viceId);
+ if (status) {
+ fprintf(stderr, "Error %d setting rxkad ViceId\n", status);
+ status = AKLOG_SUCCESS;
+ } else {
+ token_replaceToken(token, rxkadToken);
+ }
}
}
out:
if (rxkadToken) {
- free(rxkadToken->ktc_tokenUnion_u.at_kad.rk_ticket.rk_ticket_val);
- free(rxkadToken);
+ token_freeToken(&rxkadToken);
}
if (local_cell)
else
progname = argv[0];
- krb5_init_context(&context);
+#if defined(KRB5_PROG_ETYPE_NOSUPP) && !(defined(HAVE_KRB5_ENCTYPE_ENABLE) || defined(HAVE_KRB5_ALLOW_WEAK_CRYPTO))
+ {
+ char *filepath = NULL, *newpath = NULL;
+#ifndef AFS_DARWIN_ENV
+ char *defaultpath = "/etc/krb5.conf";
+#else
+ char *defaultpath = "~/Library/Preferences/edu.mit.Kerberos:/Library/Preferences/edu.mit.Kerberos";
+#endif
+ filepath = getenv("KRB5_CONFIG");
+ asprintf(&newpath, "%s:%s/krb5-weak.conf",
+ filepath ? filepath : defaultpath,
+ AFSDIR_CLIENT_ETC_DIRPATH);
+ setenv("KRB5_CONFIG", newpath, 1);
+#endif
+ krb5_init_context(&context);
+
+#if defined(KRB5_PROG_ETYPE_NOSUPP) && !(defined(HAVE_KRB5_ENCTYPE_ENABLE) || defined(HAVE_KRB5_ALLOW_WEAK_CRYPTO))
+ free(newpath);
+ if (filepath)
+ setenv("KRB5_CONFIG", filepath, 1);
+ else
+ unsetenv("KRB5_CONFIG");
+ }
+#endif
initialize_KTC_error_table ();
initialize_U_error_table();
initialize_RXK_error_table();
EncTicketPart enc_tkt_reply[1];
krb5_address address[30];
krb5_addresses faddr[1];
- int temp_vno[1];
+ unsigned int temp_vno[1];
time_t temp_time[2];
#else
krb5_ticket ticket_reply[1];
}
} /* crypto block */
ticket_reply->enc_part.etype = deref_entry_enctype(entry);
- ticket_reply->enc_part.kvno = temp_vno;
+ ticket_reply->enc_part.kvno = (void *)temp_vno;
*ticket_reply->enc_part.kvno = entry->vno;
ticket_reply->tkt_vno = 5;
#else
git://git.openafs.org / openafs.git / blobdiff