summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rwxr-xr-xConfigure23
-rw-r--r--Makefile.org4
-rw-r--r--apps/s_server.c13
-rw-r--r--crypto/asn1/asn1.h1
-rw-r--r--crypto/asn1/tasn_typ.c3
-rw-r--r--crypto/krb5/Makefile.ssl90
-rw-r--r--crypto/krb5/krb5_asn.c164
-rw-r--r--crypto/krb5/krb5_asn.h256
-rw-r--r--ssl/kssl.c948
-rw-r--r--ssl/kssl.h29
-rw-r--r--ssl/s3_clnt.c146
-rw-r--r--ssl/s3_srvr.c113
-rw-r--r--ssl/ssl.h6
-rw-r--r--ssl/ssl_err.c18
14 files changed, 1641 insertions, 173 deletions
diff --git a/Configure b/Configure
index a76f7060d6..b20e663328 100755
--- a/Configure
+++ b/Configure
@@ -723,6 +723,7 @@ if ($no_krb5
}
else
{
+ my ($lresolv, $lpath, $lext);
if ($withargs{"krb5-flavor"} =~ /^[Hh]eimdal$/)
{
$withargs{"krb5-dir"} = "/usr/heimdal"
@@ -732,7 +733,7 @@ else
if $withargs{"krb5-lib"} eq "";
$cflags="-DKRB5_HEIMDAL $cflags";
}
- if ($withargs{"krb5-flavor"} =~ /^[Mm][Ii][Tt]$/)
+ if ($withargs{"krb5-flavor"} =~ /^[Mm][Ii][Tt]/)
{
$withargs{"krb5-dir"} = "/usr/kerberos"
if $withargs{"krb5-dir"} eq "";
@@ -740,9 +741,27 @@ else
"/lib -lgssapi_krb5 -lkrb5 -lcom_err -lk5crypto"
if $withargs{"krb5-lib"} eq "";
$cflags="-DKRB5_MIT $cflags";
+ $withargs{"krb5-flavor"} =~ s/^[Mm][Ii][Tt][._-]*//;
+ if ($withargs{"krb5-flavor"} =~ /^1[._-]*[01]/)
+ {
+ $cflags="-DKRB5_MIT_OLD11 $cflags";
+ }
+ }
+ LRESOLV:
+ foreach $lpath ("/lib", "/usr/lib")
+ {
+ foreach $lext ("a", "so")
+ {
+ $lresolv = "$lpath/libresolv.$lext";
+ last LRESOLV if (-r "$lresolv");
+ $lresolv = "";
+ }
}
+ $withargs{"krb5-lib"} .= " -lresolv"
+ if ("$lresolv");
$withargs{"krb5-include"} = "-I".$withargs{"krb5-dir"}."/include"
- if $withargs{"krb5-include"} eq "" && $withargs{"krb5-dir"} ne "";
+ if $withargs{"krb5-include"} eq "" &&
+ $withargs{"krb5-dir"} ne "";
}
# The DSO code currently always implements all functions so that no
diff --git a/Makefile.org b/Makefile.org
index a7353151d5..f3258d3048 100644
--- a/Makefile.org
+++ b/Makefile.org
@@ -168,7 +168,7 @@ SDIRS= \
des rc2 rc4 rc5 idea bf cast \
bn ec rsa dsa dh dso engine rijndael \
buffer bio stack lhash rand err objects \
- evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui
+ evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5
# tests to perform. "alltests" is a special word indicating that all tests
# should be performed.
@@ -458,7 +458,7 @@ depend:
do \
if [ -d "$$i" ]; then \
(cd $$i && echo "making dependencies $$i..." && \
- $(MAKE) SDIRS='${SDIRS}' DEPFLAG='${DEPFLAG}' MAKEDEPPROG='${MAKEDEPPROG}' depend ) || exit 1; \
+ $(MAKE) SDIRS='${SDIRS}' DEPFLAG='${DEPFLAG}' MAKEDEPPROG='${MAKEDEPPROG}' KRB5_INCLUDES='${KRB5_INCLUDES}' depend ) || exit 1; \
fi; \
done;
diff --git a/apps/s_server.c b/apps/s_server.c
index 6ed23490f1..269b28dfd1 100644
--- a/apps/s_server.c
+++ b/apps/s_server.c
@@ -863,8 +863,10 @@ static int sv_body(char *hostname, int s, unsigned char *context)
#ifndef OPENSSL_NO_KRB5
if ((con->kssl_ctx = kssl_ctx_new()) != NULL)
{
- kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVICE, KRB5SVC);
- kssl_ctx_setstring(con->kssl_ctx, KSSL_KEYTAB, KRB5KEYTAB);
+ kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVICE,
+ KRB5SVC);
+ kssl_ctx_setstring(con->kssl_ctx, KSSL_KEYTAB,
+ KRB5KEYTAB);
}
#endif /* OPENSSL_NO_KRB5 */
if(context)
@@ -1249,6 +1251,13 @@ static int www_body(char *hostname, int s, unsigned char *context)
if (!BIO_set_write_buffer_size(io,bufsize)) goto err;
if ((con=SSL_new(ctx)) == NULL) goto err;
+#ifndef OPENSSL_NO_KRB5
+ if ((con->kssl_ctx = kssl_ctx_new()) != NULL)
+ {
+ kssl_ctx_setstring(con->kssl_ctx, KSSL_SERVICE, KRB5SVC);
+ kssl_ctx_setstring(con->kssl_ctx, KSSL_KEYTAB, KRB5KEYTAB);
+ }
+#endif /* OPENSSL_NO_KRB5 */
if(context) SSL_set_session_id_context(con, context,
strlen((char *)context));
diff --git a/crypto/asn1/asn1.h b/crypto/asn1/asn1.h
index ae92ad9954..bd033f85ec 100644
--- a/crypto/asn1/asn1.h
+++ b/crypto/asn1/asn1.h
@@ -822,6 +822,7 @@ DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, DISPLAYTEXT)
DECLARE_ASN1_FUNCTIONS(ASN1_PRINTABLESTRING)
DECLARE_ASN1_FUNCTIONS(ASN1_T61STRING)
DECLARE_ASN1_FUNCTIONS(ASN1_IA5STRING)
+DECLARE_ASN1_FUNCTIONS(ASN1_GENERALSTRING)
DECLARE_ASN1_FUNCTIONS(ASN1_UTCTIME)
DECLARE_ASN1_FUNCTIONS(ASN1_GENERALIZEDTIME)
DECLARE_ASN1_FUNCTIONS(ASN1_TIME)
diff --git a/crypto/asn1/tasn_typ.c b/crypto/asn1/tasn_typ.c
index 188311ccd9..804d2eeba2 100644
--- a/crypto/asn1/tasn_typ.c
+++ b/crypto/asn1/tasn_typ.c
@@ -91,6 +91,9 @@ IMPLEMENT_ASN1_FUNCTIONS(ASN1_T61STRING)
IMPLEMENT_ASN1_TYPE(ASN1_IA5STRING)
IMPLEMENT_ASN1_FUNCTIONS(ASN1_IA5STRING)
+IMPLEMENT_ASN1_TYPE(ASN1_GENERALSTRING)
+IMPLEMENT_ASN1_FUNCTIONS(ASN1_GENERALSTRING)
+
IMPLEMENT_ASN1_TYPE(ASN1_UTCTIME)
IMPLEMENT_ASN1_FUNCTIONS(ASN1_UTCTIME)
diff --git a/crypto/krb5/Makefile.ssl b/crypto/krb5/Makefile.ssl
new file mode 100644
index 0000000000..8994b486a4
--- /dev/null
+++ b/crypto/krb5/Makefile.ssl
@@ -0,0 +1,90 @@
+#
+# OpenSSL/krb5/Makefile.ssl
+#
+
+DIR= krb5
+TOP= ../..
+CC= cc
+INCLUDES= -I.. -I$(TOP) -I../../include
+CFLAG=-g
+INSTALL_PREFIX=
+OPENSSLDIR= /usr/local/ssl
+INSTALLTOP=/usr/local/ssl
+MAKE= make -f Makefile.ssl
+MAKEDEPPROG= makedepend
+MAKEDEPEND= $(TOP)/util/domd $(TOP) -MD $(MAKEDEPPROG)
+MAKEFILE= Makefile.ssl
+AR= ar r
+
+CFLAGS= $(INCLUDES) $(CFLAG)
+
+GENERAL=Makefile README
+TEST=
+APPS=
+
+LIB=$(TOP)/libcrypto.a
+LIBSRC= krb5_asn.c
+
+LIBOBJ= krb5_asn.o
+
+SRC= $(LIBSRC)
+
+EXHEADER= krb5_asn.h
+HEADER= $(EXHEADER)
+
+ALL= $(GENERAL) $(SRC) $(HEADER)
+
+top:
+ (cd ../..; $(MAKE) DIRS=crypto SDIRS=$(DIR) sub_all)
+
+all: lib
+
+lib: $(LIBOBJ)
+ $(AR) $(LIB) $(LIBOBJ)
+ $(RANLIB) $(LIB)
+ @touch lib
+
+files:
+ perl $(TOP)/util/files.pl Makefile.ssl >> $(TOP)/MINFO
+
+links:
+ $(TOP)/util/point.sh Makefile.ssl Makefile ;
+ $(PERL) $(TOP)/util/mklink.pl ../../include/openssl $(EXHEADER)
+ $(PERL) $(TOP)/util/mklink.pl ../../test $(TEST)
+ $(PERL) $(TOP)/util/mklink.pl ../../apps $(APPS)
+
+install:
+ @for i in $(EXHEADER) ; \
+ do \
+ (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
+ chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
+ done;
+
+tags:
+ ctags $(SRC)
+
+tests:
+
+lint:
+ lint -DLINT $(INCLUDES) $(SRC)>fluff
+
+depend:
+ $(MAKEDEPEND) $(INCLUDES) $(DEPFLAG) $(LIBSRC)
+
+dclean:
+ $(PERL) -pe 'if (/^# DO NOT DELETE THIS LINE/) {print; exit(0);}' $(MAKEFILE) >Makefile.new
+ mv -f Makefile.new $(MAKEFILE)
+
+clean:
+ rm -f *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+krb5_asn.o: ../../include/openssl/asn1.h ../../include/openssl/asn1t.h
+krb5_asn.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
+krb5_asn.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+krb5_asn.o: ../../include/openssl/krb5_asn.h
+krb5_asn.o: ../../include/openssl/opensslconf.h
+krb5_asn.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+krb5_asn.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+krb5_asn.o: krb5_asn.c
diff --git a/crypto/krb5/krb5_asn.c b/crypto/krb5/krb5_asn.c
new file mode 100644
index 0000000000..08d169ba52
--- /dev/null
+++ b/crypto/krb5/krb5_asn.c
@@ -0,0 +1,164 @@
+/* krb5_asn.c */
+/* Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project,
+** using ocsp/{*.h,*asn*.c} as a starting point
+*/
+/* ====================================================================
+ * Copyright (c) 2000 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com). This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <openssl/asn1.h>
+#include <openssl/asn1t.h>
+#include <openssl/krb5_asn.h>
+
+
+ASN1_SEQUENCE(KRB5_ENCDATA) = {
+ ASN1_EXP(KRB5_ENCDATA, etype, ASN1_INTEGER, 0),
+ ASN1_EXP_OPT(KRB5_ENCDATA, kvno, ASN1_INTEGER, 1),
+ ASN1_EXP(KRB5_ENCDATA, cipher, ASN1_OCTET_STRING,2)
+} ASN1_SEQUENCE_END(KRB5_ENCDATA)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_ENCDATA)
+
+
+ASN1_SEQUENCE(KRB5_PRINCNAME) = {
+ ASN1_EXP(KRB5_PRINCNAME, nametype, ASN1_INTEGER, 0),
+ ASN1_EXP_SEQUENCE_OF(KRB5_PRINCNAME, namestring, ASN1_GENERALSTRING, 1)
+} ASN1_SEQUENCE_END(KRB5_PRINCNAME)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_PRINCNAME)
+
+
+/* [APPLICATION 1] = 0x61 */
+ASN1_SEQUENCE(KRB5_TKTBODY) = {
+ ASN1_EXP(KRB5_TKTBODY, tktvno, ASN1_INTEGER, 0),
+ ASN1_EXP(KRB5_TKTBODY, realm, ASN1_GENERALSTRING, 1),
+ ASN1_EXP(KRB5_TKTBODY, sname, KRB5_PRINCNAME, 2),
+ ASN1_EXP(KRB5_TKTBODY, encdata, KRB5_ENCDATA, 3)
+} ASN1_SEQUENCE_END(KRB5_TKTBODY)
+
+ASN1_ITEM_TEMPLATE(KRB5_TICKET) =
+ ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_EXPTAG|ASN1_TFLG_APPLICATION, 1,
+ KRB5_TICKET, KRB5_TKTBODY)
+ASN1_ITEM_TEMPLATE_END(KRB5_TICKET)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_TICKET)
+
+
+/* [APPLICATION 14] = 0x6e */
+ASN1_SEQUENCE(KRB5_APREQBODY) = {
+ ASN1_EXP(KRB5_APREQBODY, pvno, ASN1_INTEGER, 0),
+ ASN1_EXP(KRB5_APREQBODY, msgtype, ASN1_INTEGER, 1),
+ ASN1_EXP(KRB5_APREQBODY, apoptions, ASN1_BIT_STRING, 2),
+ ASN1_EXP(KRB5_APREQBODY, ticket, KRB5_TICKET, 3),
+ ASN1_EXP(KRB5_APREQBODY, authenticator, KRB5_ENCDATA, 4),
+} ASN1_SEQUENCE_END(KRB5_APREQBODY)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_APREQBODY)
+
+ASN1_ITEM_TEMPLATE(KRB5_APREQ) =
+ ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_EXPTAG|ASN1_TFLG_APPLICATION, 14,
+ KRB5_APREQ, KRB5_APREQBODY)
+ASN1_ITEM_TEMPLATE_END(KRB5_APREQ)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_APREQ)
+
+
+/* Authenticator stuff */
+
+ASN1_SEQUENCE(KRB5_CHECKSUM) = {
+ ASN1_EXP(KRB5_CHECKSUM, ctype, ASN1_INTEGER, 0),
+ ASN1_EXP(KRB5_CHECKSUM, checksum, ASN1_OCTET_STRING,1)
+} ASN1_SEQUENCE_END(KRB5_CHECKSUM)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_CHECKSUM)
+
+
+ASN1_SEQUENCE(KRB5_ENCKEY) = {
+ ASN1_EXP(KRB5_ENCKEY, ktype, ASN1_INTEGER, 0),
+ ASN1_EXP(KRB5_ENCKEY, keyvalue, ASN1_OCTET_STRING,1)
+} ASN1_SEQUENCE_END(KRB5_ENCKEY)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_ENCKEY)
+
+
+/* SEQ OF SEQ; see ASN1_EXP_SEQUENCE_OF_OPT() below */
+ASN1_SEQUENCE(KRB5_AUTHDATA) = {
+ ASN1_EXP(KRB5_AUTHDATA, adtype, ASN1_INTEGER, 0),
+ ASN1_EXP(KRB5_AUTHDATA, addata, ASN1_OCTET_STRING,1)
+} ASN1_SEQUENCE_END(KRB5_AUTHDATA)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_AUTHDATA)
+
+
+/* [APPLICATION 2] = 0x62 */
+ASN1_SEQUENCE(KRB5_AUTHENTBODY) = {
+ ASN1_EXP(KRB5_AUTHENTBODY, avno, ASN1_INTEGER, 0),
+ ASN1_EXP(KRB5_AUTHENTBODY, crealm, ASN1_GENERALSTRING, 1),
+ ASN1_EXP(KRB5_AUTHENTBODY, cname, KRB5_PRINCNAME, 2),
+ ASN1_EXP_OPT(KRB5_AUTHENTBODY, cksum, KRB5_CHECKSUM, 3),
+ ASN1_EXP(KRB5_AUTHENTBODY, cusec, ASN1_INTEGER, 4),
+ ASN1_EXP(KRB5_AUTHENTBODY, ctime, ASN1_GENERALIZEDTIME, 5),
+ ASN1_EXP_OPT(KRB5_AUTHENTBODY, subkey, KRB5_ENCKEY, 6),
+ ASN1_EXP_OPT(KRB5_AUTHENTBODY, seqnum, ASN1_INTEGER, 7),
+ ASN1_EXP_SEQUENCE_OF_OPT
+ (KRB5_AUTHENTBODY, authorization, KRB5_AUTHDATA, 8),
+} ASN1_SEQUENCE_END(KRB5_AUTHENTBODY)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_AUTHENTBODY)
+
+ASN1_ITEM_TEMPLATE(KRB5_AUTHENT) =
+ ASN1_EX_TEMPLATE_TYPE(ASN1_TFLG_EXPTAG|ASN1_TFLG_APPLICATION, 2,
+ KRB5_AUTHENT, KRB5_AUTHENTBODY)
+ASN1_ITEM_TEMPLATE_END(KRB5_AUTHENT)
+
+IMPLEMENT_ASN1_FUNCTIONS(KRB5_AUTHENT)
+
diff --git a/crypto/krb5/krb5_asn.h b/crypto/krb5/krb5_asn.h
new file mode 100644
index 0000000000..c9f573cef7
--- /dev/null
+++ b/crypto/krb5/krb5_asn.h
@@ -0,0 +1,256 @@
+/* krb5_asn.h */
+/* Written by Vern Staats <staatsvr@asc.hpc.mil> for the OpenSSL project,
+** using ocsp/{*.h,*asn*.c} as a starting point
+*/
+
+/* ====================================================================
+ * Copyright (c) 1998-2000 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com). This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_KRB5_ASN_H
+#define HEADER_KRB5_ASN_H
+
+/*
+#include <krb5.h>
+*/
+#include <openssl/safestack.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/* ASN.1 from Kerberos RFC 1510
+*/
+
+/* EncryptedData ::= SEQUENCE {
+** etype[0] INTEGER, -- EncryptionType
+** kvno[1] INTEGER OPTIONAL,
+** cipher[2] OCTET STRING -- ciphertext
+** }
+*/
+typedef struct krb5_encdata_st
+ {
+ ASN1_INTEGER *etype;
+ ASN1_INTEGER *kvno;
+ ASN1_OCTET_STRING *cipher;
+ } KRB5_ENCDATA;
+
+DECLARE_STACK_OF(KRB5_ENCDATA)
+
+/* PrincipalName ::= SEQUENCE {
+** name-type[0] INTEGER,
+** name-string[1] SEQUENCE OF GeneralString
+** }
+*/
+typedef struct krb5_princname_st
+ {
+ ASN1_INTEGER *nametype;
+ STACK_OF(ASN1_GENERALSTRING) *namestring;
+ } KRB5_PRINCNAME;
+
+DECLARE_STACK_OF(KRB5_PRINCNAME)
+
+
+/* Ticket ::= [APPLICATION 1] SEQUENCE {
+** tkt-vno[0] INTEGER,
+** realm[1] Realm,
+** sname[2] PrincipalName,
+** enc-part[3] EncryptedData
+** }
+*/
+typedef struct krb5_tktbody_st
+ {
+ ASN1_INTEGER *tktvno;
+ ASN1_GENERALSTRING *realm;
+ KRB5_PRINCNAME *sname;
+ KRB5_ENCDATA *encdata;
+ } KRB5_TKTBODY;
+
+typedef STACK_OF(KRB5_TKTBODY) KRB5_TICKET;
+DECLARE_STACK_OF(KRB5_TKTBODY)
+
+
+/* AP-REQ ::= [APPLICATION 14] SEQUENCE {
+** pvno[0] INTEGER,
+** msg-type[1] INTEGER,
+** ap-options[2] APOptions,
+** ticket[3] Ticket,
+** authenticator[4] EncryptedData
+** }
+**
+** APOptions ::= BIT STRING {
+** reserved(0), use-session-key(1), mutual-required(2) }
+*/
+typedef struct krb5_ap_req_st
+ {
+ ASN1_INTEGER *pvno;
+ ASN1_INTEGER *msgtype;
+ ASN1_BIT_STRING *apoptions;
+ KRB5_TICKET *ticket;
+ KRB5_ENCDATA *authenticator;
+ } KRB5_APREQBODY;
+
+typedef STACK_OF(KRB5_APREQBODY) KRB5_APREQ;
+DECLARE_STACK_OF(KRB5_APREQBODY)
+
+
+/* Authenticator Stuff */
+
+
+/* Checksum ::= SEQUENCE {
+** cksumtype[0] INTEGER,
+** checksum[1] OCTET STRING
+** }
+*/
+typedef struct krb5_checksum_st
+ {
+ ASN1_INTEGER *ctype;
+ ASN1_OCTET_STRING *checksum;
+ } KRB5_CHECKSUM;
+
+DECLARE_STACK_OF(KRB5_CHECKSUM)
+
+
+/* EncryptionKey ::= SEQUENCE {
+** keytype[0] INTEGER,
+** keyvalue[1] OCTET STRING
+** }
+*/
+typedef struct krb5_encryptionkey_st
+ {
+ ASN1_INTEGER *ktype;
+ ASN1_OCTET_STRING *keyvalue;
+ } KRB5_ENCKEY;
+
+DECLARE_STACK_OF(KRB5_ENCKEY)
+
+
+/* AuthorizationData ::= SEQUENCE OF SEQUENCE {
+** ad-type[0] INTEGER,
+** ad-data[1] OCTET STRING
+** }
+*/
+typedef struct krb5_authorization_st
+ {
+ ASN1_INTEGER *adtype;
+ ASN1_OCTET_STRING *addata;
+ } KRB5_AUTHDATA;
+
+DECLARE_STACK_OF(KRB5_AUTHDATA);
+
+
+/* -- Unencrypted authenticator
+** Authenticator ::= [APPLICATION 2] SEQUENCE {
+** authenticator-vno[0] INTEGER,
+** crealm[1] Realm,
+** cname[2] PrincipalName,
+** cksum[3] Checksum OPTIONAL,
+** cusec[4] INTEGER,
+** ctime[5] KerberosTime,
+** subkey[6] EncryptionKey OPTIONAL,
+** seq-number[7] INTEGER OPTIONAL,
+** authorization-data[8] AuthorizationData OPTIONAL
+** }
+*/
+typedef struct krb5_authenticator_st
+ {
+ ASN1_INTEGER *avno;
+ ASN1_GENERALSTRING *crealm;
+ KRB5_PRINCNAME *cname;
+ KRB5_CHECKSUM *cksum;
+ ASN1_INTEGER *cusec;
+ ASN1_GENERALIZEDTIME *ctime;
+ KRB5_ENCKEY *subkey;
+ ASN1_INTEGER *seqnum;
+ KRB5_AUTHDATA *authorization;
+ } KRB5_AUTHENTBODY;
+
+typedef STACK_OF(KRB5_AUTHENTBODY) KRB5_AUTHENT;
+DECLARE_STACK_OF(KRB5_AUTHENTBODY)
+
+
+/* DECLARE_ASN1_FUNCTIONS(type) = DECLARE_ASN1_FUNCTIONS_name(type, type) =
+** type *name##_new(void);
+** void name##_free(type *a);
+** DECLARE_ASN1_ENCODE_FUNCTIONS(type, name, name) =
+** DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name) =
+** type *d2i_##name(type **a, unsigned char **in, long len);
+** int i2d_##name(type *a, unsigned char **out);
+** DECLARE_ASN1_ITEM(itname) = OPENSSL_EXTERN const ASN1_ITEM itname##_it
+*/
+
+DECLARE_ASN1_FUNCTIONS(KRB5_ENCDATA)
+DECLARE_ASN1_FUNCTIONS(KRB5_PRINCNAME)
+DECLARE_ASN1_FUNCTIONS(KRB5_TKTBODY)
+DECLARE_ASN1_FUNCTIONS(KRB5_APREQBODY)
+DECLARE_ASN1_FUNCTIONS(KRB5_TICKET)
+DECLARE_ASN1_FUNCTIONS(KRB5_APREQ)
+
+DECLARE_ASN1_FUNCTIONS(KRB5_CHECKSUM)
+DECLARE_ASN1_FUNCTIONS(KRB5_ENCKEY)
+DECLARE_ASN1_FUNCTIONS(KRB5_AUTHDATA)
+DECLARE_ASN1_FUNCTIONS(KRB5_AUTHENTBODY)
+DECLARE_ASN1_FUNCTIONS(KRB5_AUTHENT)
+
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+
+#ifdef __cplusplus
+}
+#endif
+#endif
+
diff --git a/ssl/kssl.c b/ssl/kssl.c
index a8b7cc4cc8..a92c87273d 100644
--- a/ssl/kssl.c
+++ b/ssl/kssl.c
@@ -56,15 +56,26 @@
*/
-/* ssl/kssl.c -- Routines to support (& debug) Kerberos5 auth for openssl
+/* ssl/kssl.c -- Routines to support (& debug) Kerberos5 auth for openssl
**
-** 19990701 VRS Started.
+** 19990701 VRS Started.
+** 200011?? Jeffrey Altman, Richard Levitte
+** Generalized for Heimdal, Newer MIT, & Win32.
+** Integrated into main OpenSSL 0.9.7 snapshots.
+** 20010413 Simon Wilkinson, VRS
+** Real RFC2712 KerberosWrapper replaces AP_REQ.
*/
#include <openssl/opensslconf.h>
#ifndef OPENSSL_NO_KRB5
#include <string.h>
+#define _XOPEN_SOURCE /* glibc2 needs this to declare strptime() */
+#include <time.h>
+
#include <openssl/ssl.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/krb5_asn.h>
/*
* When OpenSSL is built on Windows, we do not want to require that
@@ -104,6 +115,15 @@
#define krb5_kt_resolve kssl_krb5_kt_resolve
#define krb5_auth_con_init kssl_krb5_auth_con_init
+#define krb5_principal_compare kssl_krb5_principal_compare
+/* macro #define krb5_kt_get_entry kssl_krb5_kt_get_entry */
+#define krb5_decrypt_tkt_part kssl_krb5_decrypt_tkt_part
+#define krb5_timeofday kssl_krb5_timeofday
+#define krb5_rc_default kssl_krb5_rc_default
+#define krb5_krb5_rc_initialize kssl_krb5_rc_initialize
+#define krb5_krb5_rc_get_lifespan kssl_krb5_rc_get_lifespan
+#define krb5_krb5_rc_destroy kssl_krb5_rc_destroy
+
/* Prototypes for built in stubs */
void kssl_krb5_free_data_contents(krb5_context, krb5_data *);
void kssl_krb5_free_principal(krb5_context, krb5_principal );
@@ -117,6 +137,19 @@ krb5_error_code kssl_krb5_rd_req(krb5_context, krb5_auth_context *,
krb5_const krb5_data *,
krb5_const_principal, krb5_keytab,
krb5_flags *,krb5_ticket **);
+
+krb5_boolean kssl_krb5_principal_compare(krb5_context, krb5_const_principal,
+ krb5_const_principal);
+krb5_error_code krb5_decrypt_tkt_part(krb5_context, krb5_const krb5_keyblock *,
+ krb5_ticket *);
+krb5_error_code krb5_timeofday(krb5_context context, krb5_int32 *timeret);
+krb5_error_code krb5_rc_default(krb5_context context, krb5_rcache *rc);
+krb5_error_code krb5_rc_initialize(krb5_context context, krb5_rcache rc,
+ krb5_deltat lifespan);
+krb5_error_code krb5_rc_get_lifespan(krb5_context context, krb5_rcache rc,
+ krb5_deltat *lifespan);
+krb5_error_code krb5_rc_destroy(krb5_context context, krb5_rcache rc);
+
krb5_error_code kssl_krb5_mk_req_extended(krb5_context,
krb5_auth_context *,
krb5_const krb5_flags,
@@ -144,10 +177,12 @@ krb5_error_code kssl_krb5_cc_get_principal(krb5_context context,
krb5_error_code kssl_krb5_auth_con_free(krb5_context,krb5_auth_context);
/* Function pointers (almost all Kerberos functions are _stdcall) */
-static void (_stdcall *p_krb5_free_data_contents)(krb5_context, krb5_data *)=NULL;
-static void (_stdcall *p_krb5_free_principal)(krb5_context, krb5_principal )=NULL;
-static krb5_error_code(_stdcall *p_krb5_kt_resolve)(krb5_context, krb5_const char *,
- krb5_keytab *)=NULL;
+static void (_stdcall *p_krb5_free_data_contents)(krb5_context, krb5_data *)
+ =NULL;
+static void (_stdcall *p_krb5_free_principal)(krb5_context, krb5_principal )
+ =NULL;
+static krb5_error_code(_stdcall *p_krb5_kt_resolve)
+ (krb5_context, krb5_const char *, krb5_keytab *)=NULL;
static krb5_error_code (_stdcall *p_krb5_kt_default)(krb5_context,
krb5_keytab *)=NULL;
static krb5_error_code (_stdcall *p_krb5_free_ticket)(krb5_context,
@@ -158,33 +193,27 @@ static krb5_error_code (_stdcall *p_krb5_rd_req)(krb5_context,
krb5_const_principal,
krb5_keytab, krb5_flags *,
krb5_ticket **)=NULL;
-static krb5_error_code (_stdcall *p_krb5_mk_req_extended) (krb5_context,
- krb5_auth_context *,
- krb5_const krb5_flags,
- krb5_data *,
- krb5_creds *,
- krb5_data * )=NULL;
+static krb5_error_code (_stdcall *p_krb5_mk_req_extended)
+ (krb5_context, krb5_auth_context *,
+ krb5_const krb5_flags, krb5_data *, krb5_creds *,
+ krb5_data * )=NULL;
static krb5_error_code (_stdcall *p_krb5_init_context)(krb5_context *)=NULL;
static void (_stdcall *p_krb5_free_context)(krb5_context)=NULL;
static krb5_error_code (_stdcall *p_krb5_cc_default)(krb5_context,
krb5_ccache *)=NULL;
-static krb5_error_code (_stdcall *p_krb5_sname_to_principal)(krb5_context,
- krb5_const char *,
- krb5_const char *,
- krb5_int32,
- krb5_principal *)=NULL;
-static krb5_error_code (_stdcall *p_krb5_get_credentials)(krb5_context,
- krb5_const krb5_flags,
- krb5_ccache,
- krb5_creds *,
- krb5_creds * *)=NULL;
-static krb5_error_code (_stdcall *p_krb5_auth_con_init)(krb5_context,
- krb5_auth_context *)=NULL;
-static krb5_error_code (_stdcall *p_krb5_cc_get_principal)(krb5_context context,
- krb5_ccache cache,
- krb5_principal *principal)=NULL;
-static krb5_error_code (_stdcall *p_krb5_auth_con_free)(krb5_context,
- krb5_auth_context)=NULL;
+static krb5_error_code (_stdcall *p_krb5_sname_to_principal)
+ (krb5_context, krb5_const char *, krb5_const char *,
+ krb5_int32, krb5_principal *)=NULL;
+static krb5_error_code (_stdcall *p_krb5_get_credentials)
+ (krb5_context, krb5_const krb5_flags, krb5_ccache,
+ krb5_creds *, krb5_creds **)=NULL;
+static krb5_error_code (_stdcall *p_krb5_auth_con_init)
+ (krb5_context, krb5_auth_context *)=NULL;
+static krb5_error_code (_stdcall *p_krb5_cc_get_principal)
+ (krb5_context context, krb5_ccache cache,
+ krb5_principal *principal)=NULL;
+static krb5_error_code (_stdcall *p_krb5_auth_con_free)
+ (krb5_context, krb5_auth_context)=NULL;
static int krb5_loaded = 0; /* only attempt to initialize func ptrs once */
/* Function to Load the Kerberos 5 DLL and initialize function pointers */
@@ -222,6 +251,20 @@ load_krb5_dll(void)
GetProcAddress( hKRB5_32, "krb5_free_ticket" );
(FARPROC) p_krb5_rd_req =
GetProcAddress( hKRB5_32, "krb5_rd_req" );
+ (FARPROC) p_krb5_principal_compare =
+ GetProcAddress( hKRB5_32, "krb5_principal_compare" );
+ (FARPROC) p_krb5_decrypt_tkt_part =
+ GetProcAddress( hKRB5_32, "krb5_decrypt_tkt_part" );
+ (FARPROC) p_krb5_timeofday =
+ GetProcAddress( hKRB5_32, "krb5_timeofday" );
+ (FARPROC) p_krb5_rc_default =
+ GetProcAddress( hKRB5_32, "krb5_rc_default" );
+ (FARPROC) p_krb5_rc_initialize =
+ GetProcAddress( hKRB5_32, "krb5_rc_initialize" );
+ (FARPROC) p_krb5_rc_get_lifespan =
+ GetProcAddress( hKRB5_32, "krb5_rc_get_lifespan" );
+ (FARPROC) p_krb5_rc_destroy =
+ GetProcAddress( hKRB5_32, "krb5_rc_destroy" );
(FARPROC) p_krb5_kt_default =
GetProcAddress( hKRB5_32, "krb5_kt_default" );
(FARPROC) p_krb5_kt_resolve =
@@ -412,6 +455,92 @@ kssl_krb5_rd_req(krb5_context con, krb5_auth_context * pacon,
return KRB5KRB_ERR_GENERIC;
}
+krb5_boolean
+krb5_principal_compare(krb5_context con, krb5_const_principal princ1,
+ krb5_const_principal princ2)
+ {
+ if (!krb5_loaded)
+ load_krb5_dll();
+
+ if ( p_krb5_principal_compare )
+ return(p_krb5_principal_compare(con,princ1,princ2);
+ else
+ return KRB5KRB_ERR_GENERIC;
+ }
+
+krb5_error_code
+krb5_decrypt_tkt_part(krb5_context con, krb5_const krb5_keyblock *keys,
+ krb5_ticket *ticket)
+ {
+ if (!krb5_loaded)
+ load_krb5_dll();
+
+ if ( p_krb5_decrypt_tkt_part )
+ return(p_krb5_decrypt_tkt_part(con,keys,ticket);
+ else
+ return KRB5KRB_ERR_GENERIC;
+ }
+
+krb5_error_code
+krb5_timeofday(krb5_context con, krb5_int32 *timeret)
+ {
+ if (!krb5_loaded)
+ load_krb5_dll();
+
+ if ( p_krb5_timeofday )
+ return(p_krb5_timeofday(con,timeret);
+ else
+ return KRB5KRB_ERR_GENERIC;
+ }
+
+krb5_error_code
+krb5_rc_default(krb5_context con, krb5_rcache *rc)
+ {
+ if (!krb5_loaded)
+ load_krb5_dll();
+
+ if ( p_krb5_rc_default )
+ return(p_krb5_rc_default(con,rc);
+ else
+ return KRB5KRB_ERR_GENERIC;
+ }
+
+krb5_error_code
+krb5_rc_initialize(krb5_context con, krb5_rcache rc, krb5_deltat lifespan)
+ {
+ if (!krb5_loaded)
+ load_krb5_dll();
+
+ if ( p_krb5_rc_initialize )
+ return(p_krb5_rc_initialize(con, rc, lifespan);
+ else
+ return KRB5KRB_ERR_GENERIC;
+ }
+
+krb5_error_code
+krb5_rc_get_lifespan(krb5_context con, krb5_rcache rc, krb5_deltat *lifespanp)
+ {
+ if (!krb5_loaded)
+ load_krb5_dll();
+
+ if ( p_krb5_rc_get_lifespan )
+ return(p_krb5_rc_get_lifespan(con, rc, lifespanp);
+ else
+ return KRB5KRB_ERR_GENERIC;
+ }
+
+krb5_error_code
+krb5_rc_destroy(krb5_context con, krb5_rcache rc)
+ {
+ if (!krb5_loaded)
+ load_krb5_dll();
+
+ if ( p_krb5_rc_destroy )
+ return(p_krb5_rc_destroy(con, rc);
+ else
+ return KRB5KRB_ERR_GENERIC;
+ }
+
/* Structure definitions */