Problem - Kevin Tafuro

version
Version string that is sent to the server. This string is generally used to indicate a
version of the protocol that the client and server will speak to each other. It does
not have anything to do with the Kerberos protocol or the version of Kerberos in
use. The string may be anything you want, but both the client and server must
agree on the same string for authentication to succeed.
If authentication is successful, the return value from spc_krb5_client( ) will be 0,
and the relevant fields in the spc_krb5bundle_t object will be filled in. The client may
then proceed to use other Kerberos API functions to exchange encrypted and authenticated
information with the server. Of particular interest is that a key suitable for use
with a symmetric cipher is now available. (See Recipe 9.6 for an example of how to
use the key effectively.)
If any kind of error occurs while attempting to authenticate with the server, the
return value from the following spc_krb5_client( ) function will be the error code
returned by the Kerberos API function that failed. Complete lists of error codes are
available in the Heimdal and MIT Kerberos header files.
krb5_error_code spc_krb5_client(int sockfd, spc_krb5bundle_t *bundle,
char *service, char *host, char *version) {
int free_context = 0;
krb5_principal server = 0;
krb5_error_code rc;
if (!bundle->ctx) {
if ((rc = krb5_init_context(&(bundle->ctx))) != 0) goto error;
free_context = 1;
}
if ((rc = krb5_sname_to_principal(bundle->ctx, host, service,
KRB5_NT_SRV_HST, &server)) != 0) goto error;
rc = krb5_sendauth(bundle->ctx, &(bundle->auth_ctx), &sockfd, version,
0, server, AP_OPTS_MUTUAL_REQUIRED, 0, 0, 0, 0, 0, 0);
if (!rc) {
krb5_free_principal(bundle->ctx, server);
return 0;
}
error:
if (server) krb5_free_principal(bundle->ctx, server);
if (bundle->ctx && free_context) {
krb5_free_context(bundle->ctx);
bundle->ctx = 0;
}
return rc;
}
The code for the server side of the connection is similar to the client side, although it
is somewhat simplified because most of the information in the exchange comes from
the client. The function spc_krb5_server( ), listed later in this section, performs the
416 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.