Adding initial pkinit branch

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18860 dc483132-0cff-0310-8789-dd5450dbe970
Initial commit of the pkinit code

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18861 dc483132-0cff-0310-8789-dd5450dbe970
Fix segfault trying to create e-data

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18866 dc483132-0cff-0310-8789-dd5450dbe970
Pullup changes r18861:r18873 from the trunk

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18874 dc483132-0cff-0310-8789-dd5450dbe970
Pullup r18873:18915 from trunk

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18916 dc483132-0cff-0310-8789-dd5450dbe970
Update to CITI code as of 20061203

Implements e-data and client_tryagain.

Implements reading of config/profile parameters.

Some smartcard improvements.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18917 dc483132-0cff-0310-8789-dd5450dbe970
From Olga and Jim, split out pkcs7_decrypt to be able to use smartcard

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18920 dc483132-0cff-0310-8789-dd5450dbe970
Pull in changes for the extended get_init_creds_opt structure

Pull in changes to add get_init_creds_opt_set_pa(),
    get_init_creds_opt_get_pa(), and get_init_creds_opt_free_pa()

Change client interface to pass in the get_init_creds_opt structure
    to the process and tryagain functions.

Pull in changes to kinit to pass preauth options entered with "-X"

Create typedefs for all the preauth plugin client and server
    interface functions and use them.  Eliminates mismatches
    and enables better type checking of the interface paremeters.

Add *temporary* code to client side of pkinit to handle preauth options
    and set the appropriate environment variables.
    (Currently only X509_user_identity, X509_anchors, and
    flag_RSA_PROTOCOL are handled.)

Add code to use krb5int_accessor to obtain pointers to internal functions
    for ASN.1 encode/decode routines rather than exporting them from
    libkrb5.

Various updates and improvements in the pkinit smartcard code.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18937 dc483132-0cff-0310-8789-dd5450dbe970
Don't try to do any checks on the PKCS11 info,
just set the environment variable!

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@18938 dc483132-0cff-0310-8789-dd5450dbe970
Pullup r18915:r19052 from trunk

Update pkinit code to include changes for separation of the
crypto interface.

pkinit also updated to use configuration files and command-line
options rather than environment variables.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19053 dc483132-0cff-0310-8789-dd5450dbe970
Doh! Forget to add these two files!

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19054 dc483132-0cff-0310-8789-dd5450dbe970
- Add missing function prototypes in the appropriate places.
- Remove saved code which had been previously #ifdef'd out.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19057 dc483132-0cff-0310-8789-dd5450dbe970
-- thanks to Ken Renard, fixed checksum problem in the KDC.
   The KDC may alter the original request after decoding it.
   We need to do the checksum on the original request contents
   from the client.  Use the original packet data to calculate
   the checksum.
-- client now sends the certificate chain in the request
-- added a debug message for when we fail to create a certificate
   chain on the client and fail the request

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19058 dc483132-0cff-0310-8789-dd5450dbe970
Various fixes:
---
Ignore the mechanism list, always use CKM_RSA_PKCS and calculate the sha1
digest ourselves.

Works for Cryptoflex, Activcard, and (I think) CAC.
---
don't specify a usage when looking for a private key, it confuses
some cards (coolkey)
---
send invalid certificate instead of trusted certifiers for
the TD-INVALID-CERTIFICATE typed data
---
include the right oid for the draft9 reply
---
Remove all traces of krb5_get_init_creds_opt_set_pkinit()
---

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19164 dc483132-0cff-0310-8789-dd5450dbe970
Pull up r19052:r19183 from trunk

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19184 dc483132-0cff-0310-8789-dd5450dbe970
Allow pkinit to support multiple realms within a single KDC.
Allow per-realm pkinit configuration.

- include/krb5/preauth_plugin.h
  Add NULL-terminated realm name list to preauth_server_init_proc interface.

- kdc/kdc_preauth.c
  Construct realm name list and pass it to preauth_server_init_proc
  (and free it).

- plugins/preauth/pkinit/pkinit.h
  Add realmname and name length to kdc (per-realm) plugin context.
  Change interface to config/profile routines to pass the realm name.

- plugins/preauth/pkinit/pkinit_crypto_openssl.c
  Restructure the init/fini functions a bit.
  Make sure OBJ_cleanup() is only called once by using a refcount.

- plugins/preauth/pkinit/pkinit_profile.c
  Change routines to pass in realm name rather than depending on
  default_realm being set in the context.

- plugins/preauth/pkinit/pkinit_srv.c
  Create a plugin context for each realm that should be supported.
  Add function to find the correct realm context.  Call it at the
  beginning of each major preauth function (get_edata,
  verify_padata, return_padata).

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19209 dc483132-0cff-0310-8789-dd5450dbe970
Fix cksum_body preauth plugin init function definition

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19210 dc483132-0cff-0310-8789-dd5450dbe970
Pullup r19183:r19510 from trunk

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19511 dc483132-0cff-0310-8789-dd5450dbe970
[lib/krb5/asn.1/asn1_k_decode.c]
- define two macros to deal with implicitly tagged
  octet strings
- modified begin_choice() macro and removed
  begin_explicit_choice()
- use the get_implicit_octet_string() and
  opt_implicit_octet_string() macros to clean up
  a lot of hand-coded stuff.
- remove (almost) all the "#if 0" stuff (see below)

- asn1_decode_trusted_ca() still needs testing and cleanup
  of "#if 0" code!

[lib/krb5/asn.1/asn1_k_decode.h]
  - add prototype for asn1_decode_sequence_of_algorithm_identifier

[lib/krb5/asn.1/asn1_k_encode.cs]
  - Fix up some comments for our added macros

[pkinit directory changes]
- Move parsing of filesystem identity location into a separate function,
  parse_fs_options(), like parse_pkcs11_options().
- Add the ability to specify ENV: as suggested by Doug Engert.
- Add the ability to specify alternatives to use for finding identity.
  (This adds a pkinit_identity_alt config file option that specifies
  alternative locations to try and find user identity information.
  This config file option may be specified multiple times, and the
  alternatives are tried in the order given in the config file.)

  For example:

  [libdefaults]
    pkinit_identity_alt = ENV:X509_USER_IDENTITY
    pkinit_identity_alt = ENV:X509_USER_PROXY
    pkinit_identity_alt = PKCS11:opensc-pkcs11.so

  If the user does not specify -X X509_user_identity on the command
  line, then the code will check if the environment variable
  X509_USER_IDENTITY is defined. If it is not defined, or does not
  specify a valid identity, then envvar X509_USER_PROXY will be tried.
  If that fails, then it will attempt PKCS11 with module opensc-pkcs11.so.
  If all the alternatives fail, then pkinit preauth is not available
  and password authentication is attempted.


- Many changes to clean up almost all compiler warnings

- Add config option, pkinit_win2k_hostname, to specify win2k
  hostname(s) to be checked in the certificate.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19512 dc483132-0cff-0310-8789-dd5450dbe970
- Add new config file option pkinit_longhorn which indicates
  we are talking to a Longhorn KDC and allows the necessary
  hacks to work with a Longhorn (beta 3) server
- Add pkcs12 support (required for gssmonger testing)
- Modify SAN and EKU processing so that it does not use
  pa_type and so that it allows checking with certificates
  containing more than one SAN
- add new configuration file option, "pkinit_eku_checking"
  for the kdc, this can be specified as [kpClientAuth | scLogin | none]
  for the client, this can be specified as [kpKDC | kpServerAuth | none]
- Restructure code to make DN and SAN matching possible.
  Still need the actual matching code.
- Fix from Ken Renard re: using ENV: for identity processing
- Create new header, pkinit_crypto.h separating out the crypto
  interface definition.

git-svn-id: svn://anonsvn.mit.edu/krb5/users/coffman/pkinit@19549 dc483132-0cff-0310-8789-dd5450dbe970