do_tgs_req.c (process_tgs_req): Use a slightly more compressed logging

	format.

do_as_req.c (process_as_req): Unify the logging and error packet
	production, to make sure that both logging and an error packet is
	returned for each error condition.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@6939 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/ChangeLog b/src/kdc/ChangeLog
index 71e8ef7483670f27b8777144e20042f2368b2ec9..423e728366f5f5a41759b9e0719c2c9c4fec753c 100644 (file)
--- a/src/kdc/ChangeLog
+++ b/src/kdc/ChangeLog
@@ -1,3 +1,12 @@
+Fri Oct  6 00:07:49 1995  Theodore Y. Ts'o  <tytso@dcl>
+
+       * do_tgs_req.c (process_tgs_req): Use a slightly more compressed
+               logging format.
+
+       * do_as_req.c (process_as_req): Unify the logging and error packet
+               production, to make sure that both logging and an error
+               packet is returned for each error condition.
+
 Thu Oct  5 21:23:12 1995  Theodore Y. Ts'o  <tytso@dcl>
 
        * network.c (setup_network):

diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index f4079ea6c9532bccc957882b700feffea555c7df..466d3211e937f61e2690ccc8a68770e0a55eb68f 100644 (file)
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -104,7 +104,7 @@ krb5_data **response;                       /* filled in with a response packet */
     krb5_enc_kdc_rep_part reply_encpart;
     krb5_ticket ticket_reply;
     krb5_enc_tkt_part enc_tkt_reply;
-    krb5_error_code retval;
+    krb5_error_code errcode;
     int c_nprincs = 0, s_nprincs = 0;
     int pa_id, pa_flags;
     krb5_boolean more;
@@ -120,31 +120,15 @@ krb5_data **response;                     /* filled in with a response packet */
 #ifdef KRBCONF_KDC_MODIFIES_KDB
     krb5_boolean update_client = 0;
 #endif /* KRBCONF_KDC_MODIFIES_KDB */
-
+    krb5_data e_data;
     register int i;
-
     krb5_timestamp until, rtime;
     char *cname = 0, *sname = 0, *fromstring = 0;
 
     ticket_reply.enc_part.ciphertext.data = 0;
     salt_data.data = 0;
+    e_data.data = 0;
 
-    if (!request->client)
-       return(prepare_error_as(request, KDC_ERR_C_PRINCIPAL_UNKNOWN,
-                               0, response));
-    if ((retval = krb5_unparse_name(kdc_context, request->client, &cname))) {
-       krb5_klog_syslog(LOG_INFO, "AS_REQ: %s while unparsing client name",
-              error_message(retval));
-       return(prepare_error_as(request, KDC_ERR_C_PRINCIPAL_UNKNOWN,
-                               0, response));
-    }
-    if ((retval = krb5_unparse_name(kdc_context, request->server, &sname))) {
-       free(cname);
-       krb5_klog_syslog(LOG_INFO, "AS_REQ: %s while unparsing server name",
-              error_message(retval));
-       return(prepare_error_as(request, KDC_ERR_S_PRINCIPAL_UNKNOWN,
-                               0, response));
-    }
 #ifdef KRB5_USE_INET
     if (from->address->addrtype == ADDRTYPE_INET)
        fromstring = (char *) inet_ntoa(*(struct in_addr *)from->address->contents);
@@ -152,54 +136,72 @@ krb5_data **response;                     /* filled in with a response packet */
     if (!fromstring)
        fromstring = "<unknown>";
 
+    if (!request->client) {
+       status = "NULL_CLIENT";
+       errcode = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
+       goto errout;
+    }
+    if ((errcode = krb5_unparse_name(kdc_context, request->client, &cname))) {
+       status = "UNPARSING_CLIENT";
+       goto errout;
+    }
+    if (!request->server) {
+       status = "NULL_SERVER";
+       errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+       goto errout;
+    }
+    if ((errcode = krb5_unparse_name(kdc_context, request->server, &sname))) {
+       status = "UNPARSING_SERVER";
+       goto errout;
+    }
+    
     c_nprincs = 1;
-    if ((retval = krb5_db_get_principal(kdc_context, request->client, &client, 
-                                       &c_nprincs, &more))) {
+    if ((errcode = krb5_db_get_principal(kdc_context, request->client,
+                                        &client, &c_nprincs, &more))) {
+       status = "LOOKING_UP_CLIENT";
        c_nprincs = 0;
        goto errout;
     }
     if (more) {
-       retval = prepare_error_as(request, KDC_ERR_PRINCIPAL_NOT_UNIQUE,
-                                 0, response);
+       status = "NON-UNIQUE_CLIENT";
+       errcode = KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE;
        goto errout;
     } else if (c_nprincs != 1) {
+       status = "CLIENT_NOT_FOUND";
 #ifdef KRBCONF_VAGUE_ERRORS
-       retval = prepare_error_as(request, KRB_ERR_GENERIC, 0, response);
+       errcode = KRB5KRB_ERR_GENERIC;
 #else
-       retval = prepare_error_as(request, KDC_ERR_C_PRINCIPAL_UNKNOWN,
-                                 0, response);
+       errcode = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
 #endif
        goto errout;
     }
     
     s_nprincs = 1;
-    if ((retval = krb5_db_get_principal(kdc_context, request->server, &server,
-                                       &s_nprincs, &more))) {
-       s_nprincs = 0;
+    if ((errcode = krb5_db_get_principal(kdc_context, request->server, &server,
+                                        &s_nprincs, &more))) {
+       status = "LOOKING_UP_SERVER";
        goto errout;
     }
     if (more) {
-       retval = prepare_error_as(request, KDC_ERR_PRINCIPAL_NOT_UNIQUE,
-                                 0, response);
+       status = "NON-UNIQUE_SERVER";
+       errcode = KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE;
        goto errout;
     } else if (s_nprincs != 1) {
-       retval = prepare_error_as(request, KDC_ERR_S_PRINCIPAL_UNKNOWN,
-                                 0, response);
+       status = "SERVER_NOT_FOUND";
+       errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
        goto errout;
     }
 
-    if ((retval = krb5_timeofday(kdc_context, &kdc_time))) {
-       krb5_klog_syslog(LOG_INFO, "AS_REQ: TIME_OF_DAY: host %s, %s for %s", 
-                  fromstring, cname, sname);
+    if ((errcode = krb5_timeofday(kdc_context, &kdc_time))) {
+       status = "TIMEOFDAY";
        goto errout;
     }
 
-    status = "UNKNOWN REASON";
-    if ((retval = validate_as_request(request, client, server,
+    if ((errcode = validate_as_request(request, client, server,
                                      kdc_time, &status))) {
-       krb5_klog_syslog(LOG_INFO, "AS_REQ: %s: host %s, %s for %s", status,
-                  fromstring, cname, sname);
-       retval = prepare_error_as(request, retval, 0, response);
+       if (!status) 
+           status = "UNKNOWN_REASON";
+       errcode += ERROR_TABLE_BASE_krb5;
        goto errout;
     }
       
@@ -223,21 +225,19 @@ krb5_data **response;                     /* filled in with a response packet */
     }
     
     /* unsupported ktype */
-    krb5_klog_syslog(LOG_INFO,"AS_REQ: BAD ENCRYPTION TYPE: host %s, %s for %s",
-                     fromstring, cname, sname);
-    retval = prepare_error_as(request, KDC_ERR_ENCTYPE_NOSUPP, 0, response);
+    status = "BAD_ENCRYPTION_TYPE";
+    errcode = KRB5KDC_ERR_ETYPE_NOSUPP;
     goto errout;
 
 got_a_key:;
     useenctype = request->ktype[i];
     krb5_use_enctype(kdc_context, &eblock, request->ktype[i]);
     
-    if ((retval = krb5_random_key(kdc_context, &eblock,
+    if ((errcode = krb5_random_key(kdc_context, &eblock,
                                  krb5_enctype_array[useenctype]->random_sequence,
                                  &session_key))) {
        /* random key failed */
-      krb5_klog_syslog(LOG_INFO,"AS_REQ: RANDOM KEY FAILED: host %s, %s for %s",
-                       fromstring, cname, sname);
+       status = "RANDOM_KEY_FAILED";
        goto errout;
     }
 
@@ -318,9 +318,9 @@ got_a_key:;
      * Check the preauthentication if it is there.
      */
     if (request->padata) {
-       retval = check_padata(&client,request->addresses,
+       errcode = check_padata(&client,request->addresses,
                              request->padata, &pa_id, &pa_flags);
-       if (retval) {
+       if (errcode) {
 #ifdef KRBCONF_KDC_MODIFIES_KDB
            /*
             * Note: this doesn't work if you're using slave servers!!!
@@ -336,15 +336,9 @@ got_a_key:;
            client.last_failed = kdc_time;
            update_client = 1;
 #endif
-            krb5_klog_syslog(LOG_INFO, "AS_REQ: PREAUTH FAILED: host %s, %s for %s (%s)",
-                  fromstring, cname, sname, error_message(retval));
+           status = "PREAUTH_FAILED";
 #ifdef KRBCONF_VAGUE_ERRORS
-            retval = prepare_error_as(request, KRB_ERR_GENERIC, 0, response);
-#else
-           retval -= ERROR_TABLE_BASE_krb5;
-           if ((retval < 0) || (retval > 127))
-                   retval = KDC_ERR_PREAUTH_FAILED;
-            retval = prepare_error_as(request, retval, 0, response);
+           errcode = KRB5KRB_ERR_GENERIC;
 #endif
            goto errout;
        } 
@@ -364,16 +358,8 @@ got_a_key:;
      */
     status = missing_required_preauth(&client, &server, &enc_tkt_reply);
     if (status) {
-       krb5_data e_data;
-       
-       krb5_klog_syslog(LOG_INFO, "AS_REQ: Needed %s: host %s, %s for %s",
-                        status, fromstring, cname, sname);
-    
+       errcode = KRB5KDC_ERR_PREAUTH_REQUIRED;
        get_preauth_hint_list(&client, &server, &e_data);
-       retval = prepare_error_as(request, KDC_ERR_PREAUTH_REQUIRED,
-                                 &e_data, response);
-       if (e_data.data)
-           free(e_data.data);
        goto errout;
     }
 
@@ -381,16 +367,20 @@ got_a_key:;
 
     /* convert server.key into a real key (it may be encrypted
        in the database) */
-    if ((retval = krb5_dbekd_decrypt_key_data(kdc_context, &master_encblock, 
+    if ((errcode = krb5_dbekd_decrypt_key_data(kdc_context, &master_encblock, 
                                              server_key,
-                                             &encrypting_key, NULL)))
+                                              &encrypting_key, NULL))) {
+       status = "DECRYPT_SERVER_KEY";
        goto errout;
-    retval = krb5_encrypt_tkt_part(kdc_context, &eblock, &encrypting_key, 
+    }
+    errcode = krb5_encrypt_tkt_part(kdc_context, &eblock, &encrypting_key, 
                                   &ticket_reply);
     memset((char *)encrypting_key.contents, 0, encrypting_key.length);
     krb5_xfree(encrypting_key.contents);
-    if (retval)
+    if (errcode) {
+       status = "ENCRYPTING_TICKET";
        goto errout;
+    }
     ticket_reply.enc_part.kvno = server_key->key_data_kvno;
 
     /*
@@ -412,10 +402,8 @@ got_a_key:;
     }
     if (!(client_key)) {
        /* Cannot find an appropriate key */
-       krb5_klog_syslog(LOG_INFO,
-                        "AS_REQ: CANNOT FIND CLIENT KEY: host %s, %s for %s",
-                        fromstring, cname, sname);
-       retval = prepare_error_as(request, KDC_ERR_ENCTYPE_NOSUPP, 0, response);
+       status = "CANT_FIND_CLIENT_KEY";
+       errcode = KRB5KDC_ERR_ETYPE_NOSUPP;
        goto errout;
     }
 
@@ -445,10 +433,12 @@ got_a_key:;
            reply.padata = padat_tmp;
            break;
        case KRB5_KDB_SALTTYPE_NOREALM:
-           if ((retval = krb5_principal2salt_norealm(kdc_context, 
+           if ((errcode = krb5_principal2salt_norealm(kdc_context, 
                                                      request->client,
-                                                     &salt_data)))
+                                                      &salt_data))) {
+               status = "SALT_NOREALM";
                goto errout;
+           }
            padat_tmp[0]->contents = (krb5_octet *)salt_data.data;
            padat_tmp[0]->length = salt_data.length;
            reply.padata = padat_tmp;
@@ -472,8 +462,10 @@ got_a_key:;
     reply.ticket = &ticket_reply;
 
     reply_encpart.session = session_key;
-    if ((retval = fetch_last_req_info(&client, &reply_encpart.last_req)))
+    if ((errcode = fetch_last_req_info(&client, &reply_encpart.last_req))) {
+       status = "FETCH_LAST_REQ";
        goto errout;
+    }
 
     reply_encpart.nonce = request->nonce;
     reply_encpart.key_exp = client.expiration;
@@ -493,20 +485,20 @@ got_a_key:;
     reply.enc_part.kvno = client_key->key_data_kvno;
 
     /* convert client.key_data into a real key */
-    if ((retval = krb5_dbekd_decrypt_key_data(kdc_context, &master_encblock, 
+    if ((errcode = krb5_dbekd_decrypt_key_data(kdc_context, &master_encblock, 
                                              client_key,
-                                             &encrypting_key, NULL)))
+                                              &encrypting_key, NULL))) {
+       status = "DECRYPT_CLIENT_KEY";
        goto errout;
+    }
 
-    retval = krb5_encode_kdc_rep(kdc_context, KRB5_AS_REP, &reply_encpart, 
-                                &eblock, &encrypting_key,  &reply, response);
+    errcode = krb5_encode_kdc_rep(kdc_context, KRB5_AS_REP, &reply_encpart, 
+                                 &eblock, &encrypting_key,  &reply, response);
     memset((char *)encrypting_key.contents, 0, encrypting_key.length);
     krb5_xfree(encrypting_key.contents);
 
-    if (retval) {
-       krb5_klog_syslog(LOG_INFO, 
-                        "AS_REQ: ENCODE_KDC_REP: host %s, %s for %s (%s)",
-                        fromstring, cname, sname, error_message(retval));
+    if (errcode) {
+       status = "ENCODE_KDC_REP";
        goto errout;
     }
     
@@ -515,8 +507,8 @@ got_a_key:;
     memset(reply.enc_part.ciphertext.data, 0, reply.enc_part.ciphertext.length);
     free(reply.enc_part.ciphertext.data);
 
-    krb5_klog_syslog(LOG_INFO, "AS_REQ; ISSUE: authtime %d, host %s, %s for %s",
-                    authtime, fromstring, cname, sname);
+    krb5_klog_syslog(LOG_INFO, "AS_REQ %s(%d): ISSUE: authtime %d, %s for %s",
+                    fromstring, portnum, authtime, cname, sname);
 
 #ifdef KRBCONF_KDC_MODIFIES_KDB
     /*
@@ -528,6 +520,20 @@ got_a_key:;
 #endif /* KRBCONF_KDC_MODIFIES_KDB */
 
 errout:
+    if (status)
+        krb5_klog_syslog(LOG_INFO, "AS_REQ %s(%d): %s: %s for %s%s%s",
+              fromstring, portnum, status, 
+              cname ? cname : "<unknown client>",
+              sname ? sname : "<unknown server>",
+              errcode ? ", " : "",
+              errcode ? error_message(errcode) : "");
+    if (errcode) {
+       errcode -= ERROR_TABLE_BASE_krb5;
+       if (errcode < 0 || errcode > 128)
+           errcode = KRB_ERR_GENERIC;
+           
+       errcode = prepare_error_as(request, errcode, 0, response);
+    }
     if (cname)
            free(cname);
     if (sname)
@@ -559,8 +565,10 @@ errout:
     }
     if (salt_data.data)
        krb5_xfree(salt_data.data);
+    if (e_data.data)
+       krb5_xfree(e_data.data);
     
-    return retval;
+    return errcode;
 }
 
 static krb5_error_code
@@ -573,24 +581,7 @@ krb5_data **response;
     krb5_error errpkt;
     krb5_error_code retval;
     krb5_data *scratch;
-    char *cname = 0, *sname = 0;
-
-    if ((retval = krb5_unparse_name(kdc_context, request->client, &cname)))
-       krb5_klog_syslog(LOG_INFO, "AS_REQ: %s while unparsing client name for error",
-              error_message(retval));
-    if ((retval = krb5_unparse_name(kdc_context, request->server, &sname)))
-       krb5_klog_syslog(LOG_INFO, "AS_REQ: %s while unparsing server name for error",
-              error_message(retval));
-
-    krb5_klog_syslog(LOG_INFO, "AS_REQ: %s while processing request from %s for %s",
-          error_message(error+KRB5KDC_ERR_NONE),
-          cname ? cname : "UNKNOWN CLIENT", sname ? sname : "UNKNOWN SERVER");
-
-    if (cname)
-           free(cname);
-    if (sname)
-           free(sname);
-
+    
     errpkt.ctime = request->nonce;
     errpkt.cusec = 0;
 
@@ -609,7 +600,7 @@ krb5_data **response;
        free(errpkt.text.data);
        return ENOMEM;
     }
-    if (e_data) {
+    if (e_data && e_data->data) {
        errpkt.e_data = *e_data;
     } else {
        errpkt.e_data.length = 0;

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 9d8364e4b6f7092970de4ef7c776b0c556ecd96e..feb72ef84098ce66103dce9fde44238a6437f94d 100644 (file)
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -97,7 +97,7 @@ krb5_data **response;                 /* filled in with a response packet */
     /*
      * setup_server_realm() sets up the global realm-specific data pointer.
      */
-    if (retval = setup_server_realm(request->server))
+    if ((retval = setup_server_realm(request->server)))
        return retval;
 
 #ifdef KRB5_USE_INET
@@ -147,11 +147,9 @@ krb5_data **response;                      /* filled in with a response packet */
        header? */
 
     nprincs = 1;
-    if ((retval = krb5_db_get_principal(kdc_context, request->server, &server,
+    if ((errcode = krb5_db_get_principal(kdc_context, request->server, &server,
                                        &nprincs, &more))) {
-        krb5_klog_syslog(LOG_INFO,
-              "TGS_REQ: GET_PRINCIPAL: authtime %d, host %s, %s for %s (%s)",
-              authtime, fromstring, cname, sname, error_message(retval));
+       status = "LOOKING_UP_SERVER";
        nprincs = 0;
        goto cleanup;
     }
@@ -522,8 +520,8 @@ got_a_key:;
                                                request->second_ticket[st_idx]->enc_part2->client,
                                                &tmp)))
                        tmp = 0;
-               krb5_klog_syslog(LOG_INFO, "TGS_REQ: 2ND_TKT_MISMATCH: authtime %d, host %s, %s for %s, 2nd tkt client %s",
-                      authtime, fromstring, cname, sname,
+               krb5_klog_syslog(LOG_INFO, "TGS_REQ %s(%d): 2ND_TKT_MISMATCH: authtime %d, %s for %s, 2nd tkt client %s",
+                      fromstring, portnum, authtime, cname, sname,
                       tmp ? tmp : "<unknown>");
                goto cleanup;
        }
@@ -621,8 +619,8 @@ got_a_key:;
     
 cleanup:
     if (status)
-        krb5_klog_syslog(LOG_INFO, "TGS_REQ %d: %s: authtime %d, host %s, %s for %s%s%s",
-              portnum, status, authtime, fromstring,
+        krb5_klog_syslog(LOG_INFO, "TGS_REQ %s(%d): %s: authtime %d, %s for %s%s%s",
+              fromstring, portnum, status, authtime, 
               cname ? cname : "<unknown client>",
               sname ? sname : "<unknown server>",
               errcode ? ", " : "",

diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
index 07018e394f9bb1011e25688f6a504eeee4873e68..f9ce46597c0384e87ec1350fbd6603fe6e8e6929 100644 (file)
--- a/src/kdc/kdc_preauth.c
+++ b/src/kdc/kdc_preauth.c
@@ -87,11 +87,11 @@ const char *missing_required_preauth(client, server, enc_tkt_reply)
     
     if (isflagset(client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) &&
         !isflagset(enc_tkt_reply->flags, TKT_FLG_PRE_AUTH))
-       return "preauth";
+       return "NEEDED_PREAUTH";
     
     if (isflagset(client->attributes, KRB5_KDB_REQUIRES_HW_AUTH) &&
        !isflagset(enc_tkt_reply->flags, TKT_FLG_HW_AUTH))
-       return "HW preauth";
+       return "NEEDED_HW_PREAUTH";
 
     return 0;
 }