Commit 30c60aca authored by jan.koester's avatar jan.koester
Browse files

test

parent 4e0ca38a

src/krb5.cpp

+39 −2
Changes for src/krb5.cpp: 39 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -2434,6 +2434,16 @@ std::vector<uint8_t> Krb5Crypto::decrypt(const std::vector<uint8_t> &key, 
    auto Ke = dk(key, usageEnc, kLen);

    auto Ki = dk(key, usageInt, kLen);



    /* DEBUG: dump Ke and Ki */

    {

        std::cerr << "[KDC] decrypt: Ke=";

        for (auto b : Ke) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;

        std::cerr << std::dec << std::endl;

        std::cerr << "[KDC] decrypt: Ki=";

        for (auto b : Ki) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;

        std::cerr << std::dec << std::endl;

    }



    /* Split: encrypted_data || HMAC-SHA1-96 (12 bytes) */

    size_t enc_len = ciphertext.size() - CKSUM_LEN;

    std::vector<uint8_t> enc_data(ciphertext.begin(), ciphertext.begin() + enc_len);
@@ -2450,10 +2460,27 @@ std::vector<uint8_t> Krb5Crypto::decrypt(const std::vector<uint8_t> &key, 
        decrypted = cipher.decryptCTS(enc_data, zeroIv);

    }



    /* DEBUG: dump decrypted, received cksum, computed cksum */

    {

        std::cerr << "[KDC] decrypt: decrypted=";

        for (auto b : decrypted) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;

        std::cerr << std::dec << std::endl;

        std::cerr << "[KDC] decrypt: received_cksum=";

        for (auto b : received_cksum) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;

        std::cerr << std::dec << std::endl;

    }



    /* Verify HMAC-SHA1-96 over decrypted payload (confounder || plaintext) */

    auto hmac_full = netplus::hmac_sha1(Ki, decrypted);

    std::vector<uint8_t> computed_cksum(hmac_full.begin(), hmac_full.begin() + CKSUM_LEN);



    /* DEBUG: dump computed cksum */

    {

        std::cerr << "[KDC] decrypt: computed_cksum=";

        for (auto b : computed_cksum) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;

        std::cerr << std::dec << std::endl;

    }



    uint8_t diff = 0;

    for (size_t i = 0; i < CKSUM_LEN; ++i)

        diff |= computed_cksum[i] ^ received_cksum[i];
@@ -2965,10 +2992,20 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le 


                if (pdType == KRB5_PADATA_ENC_TIMESTAMP && !pdValue.empty()) {

                    foundPaEncTimestamp = true;

                    std::cerr << "[KDC] PA-ENC-TIMESTAMP found, pdValue.size=" << pdValue.size()

                    /* pdValue is the DER encoding of EncryptedData SEQUENCE;

                     * extract the cipher OCTET STRING before decrypting. */

                    Krb5EncType paEtype;

                    uint32_t paKvno;

                    std::vector<uint8_t> paCipher;

                    if (!Asn1Der::parseEncryptedData(pdValue.data(), pdValue.size(),

                                                      paEtype, paKvno, paCipher)) {

                        std::cerr << "[KDC] PA-ENC-TIMESTAMP: failed to parse EncryptedData" << std::endl;

                        continue;

                    }

                    std::cerr << "[KDC] PA-ENC-TIMESTAMP found, paCipher.size=" << paCipher.size()

                              << " client_key.size=" << client_key.size() << std::endl;

                    try {

                        auto pa_plain = Krb5Crypto::decrypt(client_key, pdValue,

                        auto pa_plain = Krb5Crypto::decrypt(client_key, paCipher,

                                                             KRB5_KU_AS_REQ_PA_ENC_TS);

                        time_t pa_time = 0;

                        uint32_t pa_usec = 0;