Add rxkad server hook function to decrypt more types of tokens

Allow tokens to be encrypted with algorithms other than DES.
The security object owner must provide an implementation
by calling rxkad_SetAltDecryptProc.

Make sure plainsiz is initialized before calling the alternate decrypt
proc.

diff --git a/src/rxkad/private_data.h b/src/rxkad/private_data.h
index 1d762ff3aa24e6928463914907d0aaba309c35a8..c80512833bb41cd97b82a0641486ee9f1e5f1d05 100644 (file)
--- a/src/rxkad/private_data.h
+++ b/src/rxkad/private_data.h
@@ -78,6 +78,7 @@ struct rxkad_sprivate {
     int (*get_key) ();         /* func. of kvno and server key ptr */
     int (*user_ok) ();         /* func called with new client name */
     afs_uint32 flags;          /* configuration flags */
+    rxkad_alt_decrypt_func alt_decrypt;
 };
 
 /* private data in server-side connection */

diff --git a/src/rxkad/rxkad.p.h b/src/rxkad/rxkad.p.h
index ce052dfd07e0fb46e59f537818161c8d97201a44..a1cdf23c1099b1446ea39e5c362c50f9f2cf3d12 100644 (file)
--- a/src/rxkad/rxkad.p.h
+++ b/src/rxkad/rxkad.p.h
@@ -93,6 +93,11 @@ typedef char rxkad_level;
 
 extern int rxkad_EpochWasSet;  /* TRUE => we called rx_SetEpoch */
 
+/* An alternate decryption function for rxkad.  Using the given kvno and
+ * enctype, decrypt the input data + length to output data + length. */
+typedef int (*rxkad_alt_decrypt_func)(int, int, void *, size_t, void *,
+                                     size_t *);
+
 #include "rxkad_prototypes.h"
 
 #endif /* OPENAFS_RXKAD_RXKAD_H */

diff --git a/src/rxkad/rxkad_prototypes.h b/src/rxkad/rxkad_prototypes.h
index a2c3517ffaa0e376026dcb0b094f6398c0847690..a297d3bee623b7caf0d283bdd767ae6ea314531e 100644 (file)
--- a/src/rxkad/rxkad_prototypes.h
+++ b/src/rxkad/rxkad_prototypes.h
@@ -124,6 +124,8 @@ extern afs_int32 rxkad_SetConfiguration(struct rx_securityClass *aobj,
                                         struct rx_connection *aconn, 
                                         rx_securityConfigVariables atype,
                                         void * avalue, void **aresult);
+extern int rxkad_SetAltDecryptProc(struct rx_securityClass *aobj,
+                                  rxkad_alt_decrypt_func alt_decrypt);
 
 /* ticket.c */
 extern int tkt_DecodeTicket(char *asecret, afs_int32 ticketLen,
@@ -149,6 +151,7 @@ extern int tkt_DecodeTicket5(char *ticket, afs_int32 ticket_len,
                             char *get_key_rock, int serv_kvno, char *name,
                             char *inst, char *cell, char *session_key,
                             afs_int32 * host, afs_int32 * start,
-                            afs_int32 * end, afs_int32 disableDotCheck);
+                            afs_int32 * end, afs_int32 disableDotCheck,
+                            rxkad_alt_decrypt_func alt_decrypt);
 
 #endif

diff --git a/src/rxkad/rxkad_server.c b/src/rxkad/rxkad_server.c
index 3a15a7b2185d17b02757e42d00022a8a99f64387..a334f4c0d0273a845fdb3f890171cd6227327c41 100644 (file)
--- a/src/rxkad/rxkad_server.c
+++ b/src/rxkad/rxkad_server.c
@@ -326,7 +326,8 @@ rxkad_CheckResponse(struct rx_securityClass *aobj,
            tkt_DecodeTicket5(tix, tlen, tsp->get_key, tsp->get_key_rock,
                              kvno, client.name, client.instance, client.cell,
                              &sessionkey, &host, &start, &end, 
-                             tsp->flags & RXS_CONFIG_FLAGS_DISABLE_DOTCHECK);
+                             tsp->flags & RXS_CONFIG_FLAGS_DISABLE_DOTCHECK,
+                             tsp->alt_decrypt);
        if (code)
            return code;
     }
@@ -474,3 +475,13 @@ afs_int32 rxkad_SetConfiguration(struct rx_securityClass *aobj,
     }
     return 0;
 }
+
+int rxkad_SetAltDecryptProc(struct rx_securityClass *aobj,
+                           rxkad_alt_decrypt_func alt_decrypt)
+{
+    struct rxkad_sprivate *private =
+    (struct rxkad_sprivate *)aobj->privateData;
+
+    private->alt_decrypt = alt_decrypt;
+    return 0;
+}

diff --git a/src/rxkad/ticket5.c b/src/rxkad/ticket5.c
index a83f7fed89bb31ac45122805c2d73fc941da304d..8fd0f02de3dd035ed0e3bc0d7ac6f383ff1c9fc8 100644 (file)
--- a/src/rxkad/ticket5.c
+++ b/src/rxkad/ticket5.c
@@ -193,7 +193,8 @@ tkt_DecodeTicket5(char *ticket, afs_int32 ticket_len,
                  int (*get_key) (char *, int, struct ktc_encryptionKey *),
                  char *get_key_rock, int serv_kvno, char *name, char *inst,
                  char *cell, char *session_key, afs_int32 * host,
-                 afs_int32 * start, afs_int32 * end, afs_int32 disableCheckdot)
+                 afs_int32 * start, afs_int32 * end, afs_int32 disableCheckdot,
+                 rxkad_alt_decrypt_func alt_decrypt)
 {
     char plain[MAXKRB5TICKETLEN];
     struct ktc_encryptionKey serv_key;
@@ -234,33 +235,41 @@ tkt_DecodeTicket5(char *ticket, afs_int32 ticket_len,
        v5_serv_kvno = *t5.enc_part.kvno;
     }
 
-    /* Check that the key type really fit into 8 bytes */
+    /* check ticket */
+    if (t5.enc_part.cipher.length > sizeof(plain))
+       goto bad_ticket;
     switch (t5.enc_part.etype) {
     case ETYPE_DES_CBC_CRC:
     case ETYPE_DES_CBC_MD4:
     case ETYPE_DES_CBC_MD5:
+       /* Check that the key type really fit into 8 bytes */
+       if (t5.enc_part.cipher.length % 8 != 0)
+           goto bad_ticket;
+
+       code = (*get_key) (get_key_rock, v5_serv_kvno, &serv_key);
+       if (code)
+           goto unknown_key;
+
+       /* Decrypt data here, save in plain, assume it will shrink */
+       code =
+           krb5_des_decrypt(&serv_key, t5.enc_part.etype,
+                            t5.enc_part.cipher.data,
+                            t5.enc_part.cipher.length, plain, &plainsiz);
+       if (code != 0)
+           goto bad_ticket;
        break;
     default:
-       goto unknown_key;
+       if (alt_decrypt != NULL) {
+           plainsiz = sizeof(plain);
+           code = alt_decrypt(v5_serv_kvno, t5.enc_part.etype,
+                              t5.enc_part.cipher.data,
+                              t5.enc_part.cipher.length, plain, &plainsiz);
+           if (code != 0)
+               goto cleanup;
+       } else
+           goto unknown_key;
     }
 
-    /* check ticket */
-    if (t5.enc_part.cipher.length > sizeof(plain)
-       || t5.enc_part.cipher.length % 8 != 0)
-       goto bad_ticket;
-
-    code = (*get_key) (get_key_rock, v5_serv_kvno, &serv_key);
-    if (code)
-       goto unknown_key;
-
-    /* Decrypt data here, save in plain, assume it will shrink */
-    code =
-       krb5_des_decrypt(&serv_key, t5.enc_part.etype,
-                        t5.enc_part.cipher.data, t5.enc_part.cipher.length,
-                        plain, &plainsiz);
-    if (code != 0)
-       goto bad_ticket;
-
     /* Decode ticket */
     code = decode_EncTicketPart(plain, plainsiz, &decr_part, &siz);
     if (code != 0)