[26202] in CVS-changelog-for-Kerberos-V5
svn rev #25542: trunk/src/ccapi/lib/win/OldCC/
daemon@ATHENA.MIT.EDU (tlyu@mit.edu)
Mon Dec 12 15:44:43 2011
Date: Mon, 12 Dec 2011 15:44:40 -0500
From: tlyu@mit.edu
Message-Id: <201112122044.pBCKiefI004660@drugstore.mit.edu>
To: cvs-krb5@mit.edu
Reply-To: krbdev@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
http://src.mit.edu/fisheye/changelog/krb5/?cs=25542
Commit By: tlyu
Log Message:
ticket: 7050
subject: windows ccapi: use a random challenge to authenticate ccapiserver.
Signed-off-by: Kevin Wasserman <kevin.wasserman@painless-security.com>
Changed Files:
U trunk/src/ccapi/lib/win/OldCC/client.cxx
Modified: trunk/src/ccapi/lib/win/OldCC/client.cxx
===================================================================
--- trunk/src/ccapi/lib/win/OldCC/client.cxx 2011-12-12 20:44:36 UTC (rev 25541)
+++ trunk/src/ccapi/lib/win/OldCC/client.cxx 2011-12-12 20:44:40 UTC (rev 25542)
@@ -239,9 +239,39 @@
static
DWORD
+make_random_challenge(DWORD *challenge_out) {
+ HCRYPTPROV provider;
+ DWORD status = 0;
+ *challenge_out = 0;
+ if (!CryptAcquireContext(&provider, NULL, NULL, PROV_RSA_FULL,
+ CRYPT_VERIFYCONTEXT)) {
+ status = GetLastError();
+ cci_check_error(status);
+ return status;
+ }
+ if (!CryptGenRandom(provider, sizeof(*challenge_out),
+ (BYTE *)challenge_out)) {
+ status = GetLastError();
+ cci_check_error(status);
+ return status;
+ }
+ if (!CryptReleaseContext(provider, 0)) {
+ /*
+ * Note: even though CryptReleaseContext() failed, we don't really
+ * care since a) we've already successfully obtained our challenge
+ * anyway and b) at least one of the potential errors, "ERROR_BUSY"
+ * does not really seem to be an error at all. So GetLastError() is
+ * logged for informational purposes only and should not be returned.
+ */
+ cci_check_error(GetLastError());
+ }
+ return status;
+}
+
+static
+DWORD
authenticate_server(Init::InitInfo& info) {
- DWORD challenge = 17; // XXX - maybe use random number
- DWORD desired_response= challenge + 1;
+ DWORD challenge, desired_response;
HANDLE hMap = 0;
LPSTR mem_name = 0;
PDWORD pvalue = 0;
@@ -255,6 +285,12 @@
cci_check_error(status);
if (!status) {
+ status = make_random_challenge(&challenge);
+ desired_response = challenge + 1;
+ cci_check_error(status);
+ }
+
+ if (!status) {
if (isNT()) {
sa.nLength = sizeof(sa);
status = alloc_own_security_descriptor_NT(&sa.lpSecurityDescriptor);
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
