remove debug (9ecdd30b) · Commits · tuxist / authdb

src/admin.cpp

+0 −5

Changes for src/admin.cpp: 0 added lines, 5 removed lines.
Original line number	Diff line number	Diff line
		@@ -466,14 +466,9 @@ namespace authdb {
		std::transform(realm.begin(), realm.end(), realm.begin(),
		[](unsigned char c){ return std::toupper(c); });
		std::string salt = realm + uname;
		std::cerr << "[ADMIN] editUser krbkey: realm=" << realm
		<< " uname=" << uname << " salt=" << salt
		<< " rawpw.len=" << editRawPw.size() << std::endl;
		auto krbKeyBytes = Krb5Crypto::string2key(
		editRawPw, salt, KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1);
		std::string hexKey = hexEncode(krbKeyBytes);
		std::cerr << "[ADMIN] editUser krbkey: hex=" << hexKey.substr(0, 32)
		<< "... len=" << krbKeyBytes.size() << std::endl;
		udat.setKrbKey(hexKey);
		upos = sizeof(AuthHeader);
		user.edit(*backend, udat, upos);

src/krb5.cpp

+23 −55

Changes for src/krb5.cpp: 23 added lines, 55 removed lines.
Original line number	Diff line number	Diff line
		@@ -2279,27 +2279,11 @@ std::vector<uint8_t> Krb5Crypto::string2key(const std::string &password,
		std::vector<uint8_t> saltBytes(salt.begin(), salt.end());
		auto tkey = pbkdf2HmacSha1(password, saltBytes, iterations, kLen);

		/* DEBUG: dump PBKDF2 output */
		{
		std::cerr << "[KDC] string2key: password=\"" << password
		<< "\" salt=\"" << salt << "\" kLen=" << kLen << std::endl;
		std::cerr << "[KDC] string2key: PBKDF2 tkey=";
		for (auto b : tkey) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;
		std::cerr << std::dec << std::endl;
		}

		/* DK(tkey, "kerberos") */
		std::string kerbStr = "kerberos";
		std::vector<uint8_t> kerbConst(kerbStr.begin(), kerbStr.end());
		auto finalKey = dk(tkey, kerbConst, kLen);

		/* DEBUG: dump final key */
		{
		std::cerr << "[KDC] string2key: final key=";
		for (auto b : finalKey) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;
		std::cerr << std::dec << std::endl;
		}

		return finalKey;
		}

		@@ -2434,16 +2418,6 @@ std::vector<uint8_t> Krb5Crypto::decrypt(const std::vector<uint8_t> &key,
		auto Ke = dk(key, usageEnc, kLen);
		auto Ki = dk(key, usageInt, kLen);

		/* DEBUG: dump Ke and Ki */
		{
		std::cerr << "[KDC] decrypt: Ke=";
		for (auto b : Ke) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;
		std::cerr << std::dec << std::endl;
		std::cerr << "[KDC] decrypt: Ki=";
		for (auto b : Ki) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;
		std::cerr << std::dec << std::endl;
		}

		/* Split: encrypted_data \|\| HMAC-SHA1-96 (12 bytes) */
		size_t enc_len = ciphertext.size() - CKSUM_LEN;
		std::vector<uint8_t> enc_data(ciphertext.begin(), ciphertext.begin() + enc_len);
		@@ -2460,27 +2434,10 @@ std::vector<uint8_t> Krb5Crypto::decrypt(const std::vector<uint8_t> &key,
		decrypted = cipher.decryptCTS(enc_data, zeroIv);
		}

		/* DEBUG: dump decrypted, received cksum, computed cksum */
		{
		std::cerr << "[KDC] decrypt: decrypted=";
		for (auto b : decrypted) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;
		std::cerr << std::dec << std::endl;
		std::cerr << "[KDC] decrypt: received_cksum=";
		for (auto b : received_cksum) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;
		std::cerr << std::dec << std::endl;
		}

		/* Verify HMAC-SHA1-96 over decrypted payload (confounder \|\| plaintext) */
		auto hmac_full = netplus::hmac_sha1(Ki, decrypted);
		std::vector<uint8_t> computed_cksum(hmac_full.begin(), hmac_full.begin() + CKSUM_LEN);

		/* DEBUG: dump computed cksum */
		{
		std::cerr << "[KDC] decrypt: computed_cksum=";
		for (auto b : computed_cksum) std::cerr << std::hex << std::setfill('0') << std::setw(2) << (int)b;
		std::cerr << std::dec << std::endl;
		}

		uint8_t diff = 0;
		for (size_t i = 0; i < CKSUM_LEN; ++i)
		diff \|= computed_cksum[i] ^ received_cksum[i];
		@@ -2999,11 +2956,8 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le
		std::vector<uint8_t> paCipher;
		if (!Asn1Der::parseEncryptedData(pdValue.data(), pdValue.size(),
		paEtype, paKvno, paCipher)) {
		std::cerr << "[KDC] PA-ENC-TIMESTAMP: failed to parse EncryptedData" << std::endl;
		continue;
		}
		std::cerr << "[KDC] PA-ENC-TIMESTAMP found, paCipher.size=" << paCipher.size()
		<< " client_key.size=" << client_key.size() << std::endl;
		try {
		auto pa_plain = Krb5Crypto::decrypt(client_key, paCipher,
		KRB5_KU_AS_REQ_PA_ENC_TS);
		@@ -3018,7 +2972,7 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le
		}
		} catch (const AuthBackendError &e) {
		/* Decryption failed = wrong key */
		std::cerr << "[KDC] PA-ENC-TIMESTAMP decrypt FAILED: " << e.what() << std::endl;
		/* Decryption failed = wrong key */
		}
		}
		}
		@@ -3073,7 +3027,24 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le
		if (req.till != 0 && req.till < endtime)
		endtime = req.till;

		uint32_t tktFlags = KRB5_TF_INITIAL \| KRB5_TF_PRE_AUTHENT \| KRB5_TF_RENEWABLE;
		uint32_t tktFlags = KRB5_TF_INITIAL \| KRB5_TF_PRE_AUTHENT;

		/* Mirror requested flags where appropriate */
		if (req.kdc_options & KRB5_TF_FORWARDABLE)
		tktFlags \|= KRB5_TF_FORWARDABLE;

		/* Only grant RENEWABLE when the client explicitly requests it.
		* RENEWABLE_OK (bit 27 = 0x10) means the client tolerates a
		* renewable ticket, but verify_as_reply() in MIT kinit requires
		* renew_till <= request->till in that case. To stay safe we
		* simply omit the flag unless KDC_OPT_RENEWABLE is present. */
		time_t renew_till_time = 0;
		if (req.kdc_options & KRB5_TF_RENEWABLE) {
		tktFlags \|= KRB5_TF_RENEWABLE;
		renew_till_time = now + _RenewableLifetime;
		if (req.rtime > 0 && req.rtime < renew_till_time)
		renew_till_time = req.rtime;
		}

		/* Build EncTicketPart */
		Krb5EncTicketPart enc_tkt;
		@@ -3084,7 +3055,7 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le
		enc_tkt.authtime = now;
		enc_tkt.starttime = now;
		enc_tkt.endtime = endtime;
		enc_tkt.renew_till = now + _RenewableLifetime;
		enc_tkt.renew_till = renew_till_time;
		enc_tkt.uid = uid;

		auto enc_tkt_data = enc_tkt.serialize();
		@@ -3110,6 +3081,7 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le
		enc_rep.sname = tgt.sname;

		auto enc_rep_data = enc_rep.serialize(true /* isAsRep */);

		auto enc_rep_cipher = Krb5Crypto::encrypt(client_key, enc_rep_data, KRB5_KU_AS_REP_ENC_PART);

		/* Build AS-REP */
		@@ -3122,7 +3094,8 @@ std::vector<uint8_t> Krb5KDC::handleStandardAsReq(const uint8_t *data, size_t le
		as_rep.enc_kvno = 1;
		as_rep.enc_part = enc_rep_cipher;

		return as_rep.serialize();
		auto as_rep_bytes = as_rep.serialize();
		return as_rep_bytes;
		}

		/*
		@@ -3564,10 +3537,6 @@ bool Krb5KDC::lookupUser(AuthBackend &backend, const Krb5Principal &principal,
		* compatibility with users created before krbkey support.
		*/
		std::string krbkeyHex = udat.getKrbKey();
		std::cerr << "[KDC] lookupUser: principal=" << principal.name
		<< " realm=" << principal.realm
		<< " krbkeyHex.len=" << krbkeyHex.size()
		<< " krbkeyHex=" << krbkeyHex.substr(0, 32) << "..." << std::endl;
		if (!krbkeyHex.empty()) {
		key = hexDecode(krbkeyHex);
		} else {
		@@ -3576,7 +3545,6 @@ bool Krb5KDC::lookupUser(AuthBackend &backend, const Krb5Principal &principal,
		key = Krb5Crypto::string2key(pwhash, salt,
		KRB5_ENCTYPE_AES256_CTS_HMAC_SHA1);
		}
		std::cerr << "[KDC] lookupUser: key.size=" << key.size() << std::endl;
		return true;
		}
		}