windows-rxkad-auth-20080902

LICENSE MIT

Add ability for users to select rxkad auth only mode.
"fs setcrypt auth".

diff --git a/src/WINNT/afsd/afsd_eventmessages.mc b/src/WINNT/afsd/afsd_eventmessages.mc
index 23fa970..2cab32c 100644 (file)
--- a/src/WINNT/afsd/afsd_eventmessages.mc
+++ b/src/WINNT/afsd/afsd_eventmessages.mc
@@ -326,6 +326,15 @@ Security Level is Clear.
 MessageId=
 Severity=Informational
 Facility=System
+SymbolicName=MSG_CRYPT_AUTH
+Language=English
+Security Level is Auth (Integrity Only).
+.
+
+
+MessageId=
+Severity=Informational
+Facility=System
 SymbolicName=MSG_CRYPT_ON
 Language=English
 Security Level is Crypt.

diff --git a/src/WINNT/afsd/afsd_init.c b/src/WINNT/afsd/afsd_init.c
index 8afab3d..82b989e 100644 (file)
--- a/src/WINNT/afsd/afsd_init.c
+++ b/src/WINNT/afsd/afsd_init.c
@@ -970,14 +970,16 @@ int afsd_InitCM(char **reasonP)
     code = RegQueryValueEx(parmKey, "SecurityLevel", NULL, NULL,
                            (BYTE *) &cryptall, &dummyLen);
     if (code == ERROR_SUCCESS) {
-        afsi_log("SecurityLevel is %s", cryptall?"crypt":"clear");
+        afsi_log("SecurityLevel is %s", cryptall == 1?"crypt": cryptall == 2?"auth":"clear");
     } else {
         cryptall = 0;
         afsi_log("Default SecurityLevel is clear");
     }
 
-    if (cryptall)
+    if (cryptall == 1)
        LogEvent(EVENTLOG_INFORMATION_TYPE, MSG_CRYPT_ON);
+    else if (cryptall == 2)
+       LogEvent(EVENTLOG_INFORMATION_TYPE, MSG_CRYPT_AUTH);
     else
        LogEvent(EVENTLOG_INFORMATION_TYPE, MSG_CRYPT_OFF);
 

diff --git a/src/WINNT/afsd/cm_conn.c b/src/WINNT/afsd/cm_conn.c
index aa5d3fc..0d450d9 100644 (file)
--- a/src/WINNT/afsd/cm_conn.c
+++ b/src/WINNT/afsd/cm_conn.c
@@ -920,10 +920,15 @@ static void cm_NewRXConnection(cm_conn_t *tcp, cm_ucell_t *ucellp,
     }
     if (ucellp->flags & CM_UCELLFLAG_RXKAD) {
         secIndex = 2;
-        if (cryptall) {
-            tcp->cryptlevel = rxkad_crypt;
-        } else {
+        switch (cryptall) {
+        case 0:
             tcp->cryptlevel = rxkad_clear;
+            break;
+        case 2:
+            tcp->cryptlevel = rxkad_auth;
+            break;
+        default:
+            tcp->cryptlevel = rxkad_crypt;
         }
         secObjp = rxkad_NewClientSecurityObject(tcp->cryptlevel,
                                                 &ucellp->sessionKey, ucellp->kvno,
@@ -1000,7 +1005,7 @@ long cm_ConnByServer(cm_server_t *serverp, cm_user_t *userp, cm_conn_t **connpp)
         lock_ObtainMutex(&tcp->mx);
         if ((tcp->flags & CM_CONN_FLAG_FORCE_NEW) ||
             (tcp->ucgen < ucellp->gen) ||
-            (tcp->cryptlevel != (cryptall ? (ucellp->flags & CM_UCELLFLAG_RXKAD ? rxkad_crypt : rxkad_clear) : rxkad_clear)))
+            (tcp->cryptlevel != (ucellp->flags & CM_UCELLFLAG_RXKAD ? (cryptall == 1 ? rxkad_crypt : (cryptall == 2 ? rxkad_auth : rxkad_clear)) : rxkad_clear)))
         {
             if (tcp->ucgen < ucellp->gen)
                 osi_Log0(afsd_logp, "cm_ConnByServer replace connection due to token update");

diff --git a/src/WINNT/afsd/cm_ioctl.c b/src/WINNT/afsd/cm_ioctl.c
index 3733c1b..a0d416d 100644 (file)
--- a/src/WINNT/afsd/cm_ioctl.c
+++ b/src/WINNT/afsd/cm_ioctl.c
@@ -2822,8 +2822,10 @@ cm_IoctlSetRxkcrypt(cm_ioctl_t *ioctlp, cm_user_t *userp)
     memcpy(&cryptall, ioctlp->inDatap, sizeof(cryptall));
 
     if (c != cryptall) {
-       if (cryptall)
+       if (cryptall == 1)
             LogEvent(EVENTLOG_INFORMATION_TYPE, MSG_CRYPT_ON);
+       else if (cryptall == 2)
+            LogEvent(EVENTLOG_INFORMATION_TYPE, MSG_CRYPT_AUTH);
        else
             LogEvent(EVENTLOG_INFORMATION_TYPE, MSG_CRYPT_OFF);
     }

diff --git a/src/WINNT/afsd/fs.c b/src/WINNT/afsd/fs.c
index 91a2093..325ca06 100644 (file)
--- a/src/WINNT/afsd/fs.c
+++ b/src/WINNT/afsd/fs.c
@@ -3998,8 +3998,10 @@ SetCryptCmd(struct cmd_syndesc *as, void *arock)
       flag = 1;
     else if (strcmp(tp, "off") == 0)
       flag = 0;
+    else if (strcmp(tp, "auth") == 0)
+      flag = 0;
     else {
-      fprintf (stderr, "%s: %s must be \"on\" or \"off\".\n", pn, tp);
+      fprintf (stderr, "%s: %s must be \"on\", \"auth\", or \"off\".\n", pn, tp);
       return EINVAL;
     }
 
@@ -4033,6 +4035,8 @@ GetCryptCmd(struct cmd_syndesc *as, void *arock)
       memcpy(&flag, tp, sizeof(afs_int32));
       printf("Security level is currently ");
       if (flag == 1)
+          printf("auth (data integrity).\n");
+      else if (flag == 1)
         printf("crypt (data security).\n");
       else
         printf("clear.\n");