diff options
| author | Richard Levitte <levitte@openssl.org> | 2001-07-31 07:21:06 +0000 |
|---|---|---|
| committer | Richard Levitte <levitte@openssl.org> | 2001-07-31 07:21:06 +0000 |
| commit | 882e891284c81c7a49b2bce28f44df3e8d6f7ffc (patch) | |
| tree | fe1e72c9ff5edce490f7da03e639ad7e54cfe0f9 /ssl/s3_srvr.c | |
| parent | 05bbf78afd4cc10c776ad141749c13c25a2daa5e (diff) | |
More Kerberos SSL changes from Jeffrey Altman <jaltman@columbia.edu>
His comments are:
First, it corrects a problem introduced in the last patch where the
kssl_map_enc() would intentionally return NULL for valid ENCTYPE
values. This was done to prevent verification of the kerberos 5
authenticator from being performed when Derived Key ciphers were
in use. Unfortunately, the authenticator verification routine was
not the only place that function was used. And it caused core dumps.
Second, it attempt to add to SSL_SESSION the Kerberos 5 Client
Principal Name.
Diffstat (limited to 'ssl/s3_srvr.c')
| -rw-r--r-- | ssl/s3_srvr.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c index 112c823a0f..53091d3577 100644 --- a/ssl/s3_srvr.c +++ b/ssl/s3_srvr.c @@ -1493,7 +1493,7 @@ static int ssl3_get_client_key_exchange(SSL *s) enc_pms.data = p; p+=enc_pms.length; - if (n != enc_ticket.length + authenticator.length + + if ((unsigned long)n != enc_ticket.length + authenticator.length + enc_pms.length + 6) { SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE, @@ -1543,6 +1543,9 @@ static int ssl3_get_client_key_exchange(SSL *s) #endif /* KSSL_DEBUG */ enc = kssl_map_enc(kssl_ctx->enctype); + if (enc == NULL) + goto err; + memset(iv, 0, EVP_MAX_IV_LENGTH); /* per RFC 1510 */ if (!EVP_DecryptInit(&ciph_ctx,enc,kssl_ctx->key,iv)) @@ -1583,6 +1586,17 @@ static int ssl3_get_client_key_exchange(SSL *s) s->method->ssl3_enc->generate_master_secret(s, s->session->master_key, pms, outl); + if (kssl_ctx->client_princ) + { + int len = strlen(kssl_ctx->client_princ); + if ( len < SSL_MAX_KRB5_PRINCIPAL_LENGTH ) + { + s->session->krb5_client_princ_len = len; + memcpy(s->session->krb5_client_princ,kssl_ctx->client_princ,len); + } + } + + /* Was doing kssl_ctx_free() here, ** but it caused problems for apache. ** kssl_ctx = kssl_ctx_free(kssl_ctx); |