pull up r25475 and r25479 from trunk

 ------------------------------------------------------------------------
 r25479 | ghudson | 2011-11-19 17:06:15 -0500 (Sat, 19 Nov 2011) | 8 lines

 ticket: 7019

 Improve documentation in preauth_plugin.h

 Also declare the verto_context structure to ensure that it is has the
 proper scope when used as the return type of the event_context
 callback.

 ------------------------------------------------------------------------
 r25475 | ghudson | 2011-11-14 21:42:58 -0500 (Mon, 14 Nov 2011) | 9 lines

 ticket: 7019
 subject: Make verto context available to kdcpreauth modules
 target_version: 1.10
 tags: pullup

 Add an event_context callback to kdcpreauth.  Adjust the internal KDC
 and main loop interfaces to pass around the event context, and expose
 it to kdcpreauth modules via the rock.

ticket: 7019
version_fixed: 1.10
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-10@25510 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/include/krb5/preauth_plugin.h b/src/include/krb5/preauth_plugin.h
index cbc57f147bd509c661dfa221b668c0f74f4f0623..a0b15a810e6bf93cd6531b46bdcf94214b92a1e3 100644 (file)
--- a/src/include/krb5/preauth_plugin.h
+++ b/src/include/krb5/preauth_plugin.h
@@ -328,6 +328,10 @@ typedef struct krb5_kdcpreauth_rock_st *krb5_kdcpreauth_rock;
 typedef struct krb5_kdcpreauth_moddata_st *krb5_kdcpreauth_moddata;
 typedef struct krb5_kdcpreauth_modreq_st *krb5_kdcpreauth_modreq;
 
+/* The verto context structure type (typedef is in verto.h; we want to avoid a
+ * header dependency for the moment). */
+struct verto_context;
+
 /* Before using a callback after version 1, modules must check the vers
  * field of the callback structure. */
 typedef struct krb5_kdcpreauth_callbacks_st {
@@ -377,6 +381,11 @@ typedef struct krb5_kdcpreauth_callbacks_st {
      * avoid a dependency on a libkdb5 type). */
     void *(*client_entry)(krb5_context context, krb5_kdcpreauth_rock rock);
 
+    /* Get a pointer to the verto context which should be used by an
+     * asynchronous edata or verify method. */
+    struct verto_ctx *(*event_context)(krb5_context context,
+                                       krb5_kdcpreauth_rock rock);
+
     /* End of version 1 kdcpreauth callbacks. */
 } *krb5_kdcpreauth_callbacks;
 
@@ -417,9 +426,13 @@ typedef void
 
 /*
  * Optional: provide pa_data to send to the client as part of the "you need to
- * use preauthentication" error.  This function is not allowed to create a
- * modreq object because we have no guarantee that the client will ever make a
- * follow-up request, or that it will hit this KDC if it does.
+ * use preauthentication" error.  The implementation must invoke the respond
+ * when complete, whether successful or not, either before returning or
+ * asynchronously using the verto context returned by cb->event_context().
+ *
+ * This function is not allowed to create a modreq object because we have no
+ * guarantee that the client will ever make a follow-up request, or that it
+ * will hit this KDC if it does.
  */
 typedef void
 (*krb5_kdcpreauth_edata_fn)(krb5_context context, krb5_kdc_req *request,
@@ -450,7 +463,8 @@ typedef void
  * Optional: verify preauthentication data sent by the client, setting the
  * TKT_FLG_PRE_AUTH or TKT_FLG_HW_AUTH flag in the enc_tkt_reply's "flags"
  * field as appropriate.  The implementation must invoke the respond function
- * when complete, whether successful or not.
+ * when complete, whether successful or not, either before returning or
+ * asynchronously using the verto context returned by cb->event_context().
  */
 typedef void
 (*krb5_kdcpreauth_verify_fn)(krb5_context context,

diff --git a/src/include/net-server.h b/src/include/net-server.h
index e84bdac242b4b6d9c54f865fcbc58b2decfb5635..43310ceb04d6e4b60d40f627b9e99e08826913a7 100644 (file)
--- a/src/include/net-server.h
+++ b/src/include/net-server.h
@@ -68,7 +68,7 @@ typedef void (*loop_respond_fn)(void *arg, krb5_error_code code,
                                 krb5_data *response);
 void dispatch(void *handle, struct sockaddr *local_addr,
               const krb5_fulladdr *remote_addr, krb5_data *request,
-              int is_tcp, loop_respond_fn respond, void *arg);
+              int is_tcp, verto_ctx *vctx, loop_respond_fn respond, void *arg);
 krb5_error_code make_toolong_error (void *handle, krb5_data **);
 
 /*

diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index 8e38cfd04304db86cd98bd660dabb6cd40396294..d2df5db73bba93313942e65f18b4bc7a4911a556 100644 (file)
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -442,7 +442,7 @@ bailout:
 void
 dispatch(void *handle, struct sockaddr *local_saddr,
          const krb5_fulladdr *remote_faddr, krb5_data *request, int is_tcp,
-         loop_respond_fn respond, void *arg)
+         verto_ctx *vctx, loop_respond_fn respond, void *arg)
 {
     krb5_error_code ret;
     krb5_keytab kt = NULL;

diff --git a/src/kdc/dispatch.c b/src/kdc/dispatch.c
index eeb95ff73799047f58a34f63ed07bd2d63787772..75e6f0a604e0b406420b484dd6b0314a113e1c32 100644 (file)
--- a/src/kdc/dispatch.c
+++ b/src/kdc/dispatch.c
@@ -81,8 +81,9 @@ finish_dispatch(void *arg, krb5_error_code code, krb5_data *response)
 }
 
 void
-dispatch(void *cb, struct sockaddr *local_saddr, const krb5_fulladdr *from,
-         krb5_data *pkt, int is_tcp, loop_respond_fn respond, void *arg)
+dispatch(void *cb, struct sockaddr *local_saddr,
+         const krb5_fulladdr *from, krb5_data *pkt, int is_tcp,
+         verto_ctx *vctx, loop_respond_fn respond, void *arg)
 {
     krb5_error_code retval;
     krb5_kdc_req *as_req;
@@ -166,7 +167,8 @@ dispatch(void *cb, struct sockaddr *local_saddr, const krb5_fulladdr *from,
              * process_as_req frees the request if it is called
              */
             if (!(retval = setup_server_realm(as_req->server))) {
-                process_as_req(as_req, pkt, from, finish_dispatch, state);
+                process_as_req(as_req, pkt, from, vctx, finish_dispatch,
+                               state);
                 return;
             }
             else

diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index 08da953a1af588bdfabc2e2bf9a2e4336cf49d45..5d7fc221c195b58384a11fa34f06ede04ce7b8d1 100644 (file)
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -452,7 +452,8 @@ finish_preauth(void *arg, krb5_error_code code)
 /*ARGSUSED*/
 void
 process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
-               const krb5_fulladdr *from, loop_respond_fn respond, void *arg)
+               const krb5_fulladdr *from, verto_ctx *vctx,
+               loop_respond_fn respond, void *arg)
 {
     krb5_error_code errcode;
     krb5_timestamp rtime;
@@ -531,6 +532,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
     state->rock.request = state->request;
     state->rock.inner_body = state->inner_body;
     state->rock.rstate = state->rstate;
+    state->rock.vctx = vctx;
     if (!state->request->client) {
         state->status = "NULL_CLIENT";
         errcode = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;

diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
index 83f73dbbd42f48299950add0ef5301b152041ffe..9d8cb3453981755d21879de91514bea8588086fc 100644 (file)
--- a/src/kdc/kdc_preauth.c
+++ b/src/kdc/kdc_preauth.c
@@ -574,6 +574,12 @@ client_entry(krb5_context context, krb5_kdcpreauth_rock rock)
     return rock->client;
 }
 
+static verto_ctx *
+event_context(krb5_context context, krb5_kdcpreauth_rock rock)
+{
+    return rock->vctx;
+}
+
 static struct krb5_kdcpreauth_callbacks_st callbacks = {
     1,
     max_time_skew,
@@ -583,7 +589,8 @@ static struct krb5_kdcpreauth_callbacks_st callbacks = {
     fast_armor,
     get_string,
     free_string,
-    client_entry
+    client_entry,
+    event_context
 };
 
 static krb5_error_code

diff --git a/src/kdc/kdc_util.h b/src/kdc/kdc_util.h
index 3b146c72bc90244a554a35cc292f7e1fc9920e65..defb5bb791de046bb36e14e93d1deee71410007a 100644 (file)
--- a/src/kdc/kdc_util.h
+++ b/src/kdc/kdc_util.h
@@ -121,7 +121,7 @@ rep_etypes2str(char *s, size_t len, krb5_kdc_rep *rep);
 void
 process_as_req (krb5_kdc_req *, krb5_data *,
                 const krb5_fulladdr *,
-                loop_respond_fn, void *);
+                verto_ctx *, loop_respond_fn, void *);
 
 /* do_tgs_req.c */
 krb5_error_code
@@ -135,6 +135,7 @@ dispatch (void *,
           const krb5_fulladdr *,
           krb5_data *,
           int,
+          verto_ctx *,
           loop_respond_fn,
           void *);
 
@@ -168,9 +169,9 @@ missing_required_preauth (krb5_db_entry *client,
                           krb5_enc_tkt_part *enc_tkt_reply);
 typedef void (*kdc_hint_respond_fn)(void *arg);
 void
-get_preauth_hint_list(krb5_kdc_req *request, krb5_kdcpreauth_rock rock,
-                      krb5_pa_data ***e_data_out, kdc_hint_respond_fn respond,
-                      void *arg);
+get_preauth_hint_list(krb5_kdc_req *request,
+                      krb5_kdcpreauth_rock rock, krb5_pa_data ***e_data_out,
+                      kdc_hint_respond_fn respond, void *arg);
 void
 load_preauth_plugins(krb5_context context);
 void
@@ -400,6 +401,7 @@ struct krb5_kdcpreauth_rock_st {
     krb5_db_entry *client;
     krb5_key_data *client_key;
     struct kdc_request_state *rstate;
+    verto_ctx *vctx;
 };
 
 #define isflagset(flagfield, flag) (flagfield & (flag))

diff --git a/src/lib/apputils/net-server.c b/src/lib/apputils/net-server.c
index 9df909faca61e12c3acfb36559009f45cbb8e456..43be27c95141ab46fe35d152972fc5ee5e3c95ef 100644 (file)
--- a/src/lib/apputils/net-server.c
+++ b/src/lib/apputils/net-server.c
@@ -1665,7 +1665,7 @@ process_packet(verto_ctx *ctx, verto_ev *ev)
     init_addr(&state->faddr, ss2sa(&state->saddr));
     /* This address is in net order. */
     dispatch(state->handle, ss2sa(&state->daddr), &state->faddr,
-             &state->request, 0, process_packet_response, state);
+             &state->request, 0, ctx, process_packet_response, state);
 }
 
 static int
@@ -1936,7 +1936,7 @@ process_tcp_connection_read(verto_ctx *ctx, verto_ev *ev)
             local_saddrp = ss2sa(&state->local_saddr);
 
         dispatch(state->conn->handle, local_saddrp, &conn->faddr,
-                 &state->request, 1, process_tcp_response, state);
+                 &state->request, 1, ctx, process_tcp_response, state);
     }
 
     return;