#define _XOPEN_SOURCE /* glibc2 needs this to declare strptime() */
#include <time.h>
+#undef _XOPEN_SOURCE /* To avoid clashes with anything else... */
#include <string.h>
#include <openssl/ssl.h>
const EVP_CIPHER *enc = NULL;
unsigned char iv[EVP_MAX_IV_LENGTH];
unsigned char *p, *unenc_authent;
- int padl, outl, unencbufsize;
+ int outl, unencbufsize;
struct tm tm_time, *tm_l, *tm_g;
time_t now, tl, tg, tr, tz_offset;
*/
goto err;
}
- if (!EVP_DecryptInit_ex(&ciph_ctx, enc, NULL, kssl_ctx->key, iv))
- {
- kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
- "EVP_DecryptInit_ex error decrypting authenticator.\n");
- krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
- goto err;
- }
- if (!EVP_DecryptUpdate(&ciph_ctx, unenc_authent, &outl,
- dec_authent->cipher->data, dec_authent->cipher->length))
- {
- kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
- "EVP_DecryptUpdate error decrypting authenticator.\n");
- krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
- goto err;
- }
- if (outl > unencbufsize)
- {
- kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
- "Buffer overflow decrypting authenticator.\n");
- krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
- goto err;
- }
- if (!EVP_DecryptFinal_ex(&ciph_ctx, &(unenc_authent[outl]), &padl))
- {
- kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
- "EVP_DecryptFinal_ex error decrypting authenticator.\n");
- krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
- goto err;
- }
- outl += padl;
- if (outl > unencbufsize)
- {
- kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
- "Buffer overflow decrypting authenticator.\n");
- krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
- goto err;
- }
- EVP_CIPHER_CTX_cleanup(&ciph_ctx);
+
+ if (!EVP_CipherInit(&ciph_ctx,enc,kssl_ctx->key,iv,0))
+ {
+ kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
+ "EVP_CipherInit error decrypting authenticator.\n");
+ krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+ goto err;
+ }
+ outl = dec_authent->cipher->length;
+ if (!EVP_Cipher(&ciph_ctx,unenc_authent,dec_authent->cipher->data,outl))
+ {
+ kssl_err_set(kssl_err, SSL_R_KRB5_S_INIT,
+ "EVP_Cipher error decrypting authenticator.\n");
+ krb5rc = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+ goto err;
+ }
+ EVP_CIPHER_CTX_cleanup(&ciph_ctx);
#ifdef KSSL_DEBUG
printf("kssl_check_authent: decrypted authenticator[%d] =\n", outl);
if (auth) KRB5_AUTHENT_free((KRB5_AUTHENT *) auth);
if (dec_authent) KRB5_ENCDATA_free(dec_authent);
if (unenc_authent) free(unenc_authent);
+ EVP_CIPHER_CTX_cleanup(&ciph_ctx);
return krb5rc;
}