auth-krb: Move pac related util functions in a single place.

Signed-off-by: Andreas Schneider <asn@samba.org>

4 files changed, 78 insertions, 11 deletions

diff --git a/auth/kerberos/gssapi_pac.c b/auth/kerberos/gssapi_pac.c
index 07c7c942056..05065b2725b 100644
--- a/auth/kerberos/gssapi_pac.c
+++ b/auth/kerberos/gssapi_pac.c
@@ -22,6 +22,7 @@
 #ifdef HAVE_KRB5
 
 #include "libcli/auth/krb5_wrap.h"
+#include "auth/kerberos/pac_utils.h"
 
 #if 0
 /* FIXME - need proper configure/waf test
diff --git a/auth/kerberos/kerberos_pac.c b/auth/kerberos/kerberos_pac.c
index 5155c9fd289..eacf39d321e 100644
--- a/auth/kerberos/kerberos_pac.c
+++ b/auth/kerberos/kerberos_pac.c
@@ -26,7 +26,7 @@
 #ifdef HAVE_KRB5
 
 #include "librpc/gen_ndr/ndr_krb5pac.h"
-#include "libcli/auth/krb5_wrap.h"
+#include "auth/kerberos/pac_utils.h"
 
 krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
 					  struct PAC_SIGNATURE_DATA *sig,
@@ -36,8 +36,18 @@ krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
 	krb5_error_code ret;
 	krb5_checksum cksum;
 	krb5_keyusage usage = 0;
-
-	smb_krb5_checksum_from_pac_sig(&cksum, sig);
+	krb5_boolean checksum_valid = false;
+	krb5_data input;
+
+#ifdef HAVE_CHECKSUM_IN_KRB5_CHECKSUM /* Heimdal */
+	cksum.cksumtype	= (krb5_cksumtype)sig->type;
+	cksum.checksum.length	= sig->signature.length;
+	cksum.checksum.data	= sig->signature.data;
+#else /* MIT */
+	cksum.checksum_type	= (krb5_cksumtype)sig->type;
+	cksum.length		= sig->signature.length;
+	cksum.contents		= sig->signature.data;
+#endif
 
 #ifdef HAVE_KRB5_KU_OTHER_CKSUM /* Heimdal */
 	usage = KRB5_KU_OTHER_CKSUM;
@@ -47,14 +57,19 @@ krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
 #error UNKNOWN_KRB5_KEYUSAGE
 #endif
 
-	ret = smb_krb5_verify_checksum(context,
-				       keyblock,
-				       usage,
-				       &cksum,
-				       pac_data.data,
-				       pac_data.length);
-
-	if (ret) {
+	input.data = (char *)pac_data.data;
+	input.length = pac_data.length;
+
+	ret = krb5_c_verify_checksum(context,
+				     keyblock,
+				     usage,
+				     &input,
+				     &cksum,
+				     &checksum_valid);
+	if (!checksum_valid) {
+		ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+	}
+	if (ret){
 		DEBUG(2,("check_pac_checksum: PAC Verification failed: %s (%d)\n",
 			error_message(ret), ret));
 		return ret;
diff --git a/auth/kerberos/pac_utils.h b/auth/kerberos/pac_utils.h
new file mode 100644
index 00000000000..9fe08de834c
--- /dev/null
+++ b/auth/kerberos/pac_utils.h
@@ -0,0 +1,50 @@
+/*
+   Unix SMB/CIFS implementation.
+   kerberos authorization data (PAC) utility library
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2011
+   Copyright (C) Simo Sorce 2010-2012
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _PAC_UTILS_H
+#define _PAC_UTILS_H
+
+#include "libcli/auth/krb5_wrap.h"
+struct PAC_SIGNATURE_DATA;
+struct PAC_DATA;
+
+krb5_error_code check_pac_checksum(DATA_BLOB pac_data,
+				   struct PAC_SIGNATURE_DATA *sig,
+				   krb5_context context,
+				   const krb5_keyblock *keyblock);
+
+NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
+			     DATA_BLOB pac_data_blob,
+			     krb5_context context,
+			     const krb5_keyblock *krbtgt_keyblock,
+			     const krb5_keyblock *service_keyblock,
+			     krb5_const_principal client_principal,
+			     time_t tgs_authtime,
+			     struct PAC_DATA **pac_data_out);
+
+NTSTATUS gssapi_obtain_pac_blob(TALLOC_CTX *mem_ctx,
+				gss_ctx_id_t gssapi_context,
+				gss_name_t gss_client_name,
+				DATA_BLOB *pac_data);
+NTSTATUS gssapi_get_session_key(TALLOC_CTX *mem_ctx,
+				gss_ctx_id_t gssapi_context,
+				DATA_BLOB *session_key,
+				uint32_t *keytype);
+#endif /* _PAC_UTILS_H */
diff --git a/auth/kerberos/wscript_build b/auth/kerberos/wscript_build
index 2421b1654f8..f49cc517bab 100644..100755
--- a/auth/kerberos/wscript_build
+++ b/auth/kerberos/wscript_build
@@ -1,3 +1,4 @@
+#!/usr/bin/env python
 bld.SAMBA_SUBSYSTEM('KRB5_PAC',
                     source='gssapi_pac.c kerberos_pac.c',
                     deps='gssapi_krb5 krb5 ndr-krb5pac com_err')