Permalink
Switch branches/tags
Nothing to show
Find file
Fetching contributors…
Cannot retrieve contributors at this time
684 lines (569 sloc) 18.7 KB
/* Ben Fried deserves credit for writing the code that upon which
* this source is based. ADC
*/
#include "../config.h"
#if defined(KRB4) || defined(KRB5)
#include <stdio.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <pwd.h>
#include "HTAAUtil.h" /* for HTAA_KERBEROS_Vx defines */
#ifdef KRB4
#include <krb.h>
#define MAX_KDATA_LEN MAX_KTXT_LEN
static des_cblock session; /* Our session key */
static des_key_schedule schedule; /* Schedule for our session key */
int k4checksum;
#endif
#ifdef KRB5
#include <krb5.h>
#include <krb_err.h>
#ifndef MAX_KDATA_LEN
#define MAX_KDATA_LEN 1250
#endif
#define KRB5_DEFAULT_LIFE 60*60*8 /* 8 hours */
krb5_auth_context *k5auth_context;
krb5_context k5context = 0;
krb5_ccache k5ccache;
#endif
/* is all of this necessary? ADC */
char *getenv(), *getlogin(); /* *index(), *malloc(), *realloc(); */
struct passwd *getpwnam(), *getpwuid();
static char *envariables[] = { "USER", "LOGNAME" };
extern int useAFS; /* perhaps change name */
int doing_kerb_auth = 0;
char phost[1024];
char Hostname[1024];
#define NIL 0
#define T 1
/* Table for converting binary values to and from hexadecimal */
static char hex[] = "0123456789abcdef";
static char dec[256] = {
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 0 - 15 */
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 16 - 37 */
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* ' ' - '/' */
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 0, 0, 0, 0, 0, /* '0' - '?' */
0,10,11,12,13,14,15, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* '@' - 'O' */
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 'P' - '_' */
0,10,11,12,13,14,15, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* '`' - 'o' */
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, /* 'p' - DEL */
};
/****************************************************************************
* scheme_login -- lets user login for Kerberos TGT
*
* Returns 0 on success
* Returns 1 on failure (after reporting error to user)
***************************************************************************/
int scheme_login(scheme)
int scheme;
{
char *username, *password, buf[BUFSIZ], erbuf[BUFSIZ];
int code;
username = (char *) prompt_for_string("Kerberos Username:");
if (!username || !*username) {
application_user_info_wait("You did not enter a Username.\nCannot get Kerberos ticket-granting ticket\n");
return 1;
}
sprintf(buf, "Password for %s:", username);
password = (char *) prompt_for_password(buf);
if (!password || !*password) {
application_user_info_wait("You did not enter a Password.\nCannot obtain ticket-granting ticket\n");
return 1;
}
if (0) { /* just to get things started */
}
#ifdef KRB4
else if (scheme == HTAA_KERBEROS_V4) {
if (useAFS) {
code = AFSgetTGT(username, password, buf);
}
else {
code = k4getTGT(username, password, buf);
}
}
#endif
#ifdef KRB5
else if (scheme == HTAA_KERBEROS_V5) {
code = k5getTGT(username, password, buf);
}
#endif
memset(password, 0, sizeof(password));
if (code) {
sprintf(erbuf,"Kerberos login error:\n%s",buf);
application_user_info_wait(erbuf);
return 1;
}
return 0;
}
/****************************************************************************
* AFSgetTGT() -- Uses klog to get the K4 TGT
*
* Returns 1 if pipe open fails
* Returns 0 otherwise (even if klog fails!)
***************************************************************************/
int AFSgetTGT(username, password, err_string)
char *err_string, *username, *password;
{
char reason[256];
register int code;
FILE *fp;
char lngbuf[BUFSIZ*2],buf[BUFSIZ];
char stop=0;
int n;
sprintf(buf,"klog -tmp -pr %s -pa %s 2>&1",username,password);
if (!(fp=popen(buf,"r"))) {
application_user_info_wait("Error: Could not startup external klog command.\n");
return(1);
}
strcpy(buf," ");
strcpy(lngbuf," ");
n=1;
while (n>0) {
n=fread(buf,sizeof(char),BUFSIZ-1,fp);
if (n>0) {
if (!stop && (n+strlen(lngbuf))<BUFSIZ*2) {
buf[n]='\0';
strcat(lngbuf,buf);
}
else {
stop=1;
}
}
}
pclose(fp);
if (strlen(lngbuf)>1) {
application_user_info_wait(lngbuf);
}
return(0);
}
#ifdef KRB4
/****************************************************************************
* passwd_to_key -- convert users password to numeric key
*
* (cribbed from MIT's krb_get_in_tkt.c)
* this can probably be augmented to support Transarc's string-to-key
***************************************************************************/
static int passwd_to_key(user,instance,realm,passwd,key)
char *user, *instance, *realm, *passwd;
C_Block key;
{
string_to_key(passwd, key);
return (0);
}
/****************************************************************************
* k4getTGT() -- calls K4 libraries to get TGT (non-AFS)
*
* Returns 0 on success (err_string = "")
* Returns 1 on failure (err_string = something meaningful)
***************************************************************************/
int k4getTGT(username, password, err_string)
char *err_string, *username, *password;
{
char instance[INST_SZ], *sinstance;
char realm[REALM_SZ];
char pname[MAX_K_NAME_SZ];
int lifetime = DEFAULT_TKT_LIFE;
int code;
*instance = '\0'; /* assume client principal "user@realm" (no instance */
krb_get_lrealm(realm, 1); /* get local realm */
strcpy(pname, username);
strcat(pname, "@");
strncat(pname, realm, REALM_SZ);
sinstance = realm; /* assume tgt is for krbtgt.realm@realm */
in_tkt(pname, instance); /* to initialize ticket store */
code = krb_get_in_tkt(username, instance, realm, "krbtgt", sinstance,
lifetime, passwd_to_key , NULL, password);
if (code == INTK_BADPW) {
strcpy(err_string, "Wrong password");
return 1;
}
else if (code != INTK_OK) {
strcpy(err_string, krb_err_txt[code]);
return 1;
}
return 0;
}
#endif /* KRB4 */
#ifdef KRB5
/****************************************************************************
* k5getTGT() -- calls K5 libraries to get TGT (non-AFS)
* most of this was copied from the Krb5 kinit.c
*
* Returns 0 on success (err_string = "")
* Returns 1 on failure (err_string = something meaningful)
***************************************************************************/
int k5getTGT(username, password, err_string)
char *username, *password, *err_string;
{
int code, options = 0; /* KRB5_DEFAULT_OPTIONS = 0 */
krb5_creds my_creds;
krb5_timestamp now;
krb5_principal me, server;
krb5_preauthtype *preauth = NULL;
/* SWP -- For CodeCenter --
krb5_data tgtname = {
0,
KRB5_TGS_NAME_SIZE,
KRB5_TGS_NAME
};
*/
krb5_data tgtname;
tgtname.magic = 0;
tgtname.length = KRB5_TGS_NAME_SIZE;
tgtname.data = KRB5_TGS_NAME;
if (code = krb5_timeofday(k5context, &now)) {
sprintf(err_string,"Wouldn't tell you the time of day");
return 1;
}
if (code = krb5_parse_name(k5context, username, &me)) {
sprintf(err_string,"Couldn't find client principal name");
return 1;
}
if (code = krb5_cc_initialize (k5context, k5ccache, me)) {
sprintf(err_string,"Couldn't initialize credentials cache");
return 1;
}
memset((char *)&my_creds, 0, sizeof(my_creds));
my_creds.client = me;
if (code = krb5_build_principal_ext(k5context, &server,
krb5_princ_realm(k5context, me)->length,
krb5_princ_realm(k5context, me)->data,
tgtname.length, tgtname.data,
krb5_princ_realm(kcontext, me)->length,
krb5_princ_realm(kcontext, me)->data,
0)) {
sprintf(err_string,"Couldn't build server principal name");
return 1;
}
my_creds.server = server;
my_creds.times.starttime = 0;
my_creds.times.endtime = 0; /* now + KRB5_DEFAULT_LIFE; */
my_creds.times.renew_till = 0;
code = krb5_get_in_tkt_with_password(k5context, options, 0,
NULL, preauth, password, k5ccache, &my_creds, 0);
/* eytpyes = NULL means use default etype for decoding tgt */
/* addrs = 0 means use default local (client machine) address */
if (code) {
sprintf(err_string,"krb5_get_in_tkt error: %s", error_message(code));
return 1;
}
else {
return 0;
}
}
#endif
/*************************************************************************
* kdata_to_str -- convert 8-bit char array to ascii string
*
* Accepts: input array and length
* Returns: a pointer to the result, or null pointer on malloc failure
* The caller is responsible for freeing the returned value.
*
* Changed to accomodate general strings with length, due to conflict between
* KTEXT and krb5_data types ( 6/28/95 ADC)
************************************************************************/
static char *kdata_to_str(in_data, length)
char *in_data; /* char FAR ?? */
int length;
{
char *result, *p;
int i;
p = result = malloc(length*2+1);
if (!result) return (char *) NULL;
for (i=0; i < length; i++) {
*p++ = hex[(in_data[i]>>4)&0xf];
*p++ = hex[(in_data[i])&0xf];
}
*p++ = '\0';
return result;
}
/*************************************************************************
* str_to_kdata -- Converts ascii string to a (binary) char array
*
* Accepts: string to convert
* pointer to output array
* Returns: length of output array, NIL on failure
************************************************************************/
int str_to_kdata(in_str, out_str)
char *in_str;
char *out_str;
{
int inlen, outlen;
inlen = strlen(in_str);
if (inlen & 1) return NIL; /* must be even number, in this scheme */
inlen /= 2;
if (inlen > MAX_KDATA_LEN) return NIL;
for (outlen=0; *in_str; outlen++, in_str += 2) {
out_str[outlen] = (dec[in_str[0]]<<4) + dec[in_str[1]];
}
return outlen;
}
/****************************************************************************
* compose_kerberos_auth_string
*
* Accepts: scheme (one of the HTAA_KERBEROS values)
* hostname
* Returns: Authorization string (NULL, upon failure)
***************************************************************************/
char *compose_kerberos_auth_string(scheme, hostname)
HTAAScheme scheme;
char *hostname;
{
struct hostent *host_name;
char user[BUFSIZ], *inst, *pass, *tmp = 0;
int code, retval, firsttime = 1;
char buf[BUFSIZ], krb_err_str[BUFSIZ];
#ifdef KRB4
CREDENTIALS k4cr, k4c;
KTEXT_ST k4authent;
Key_schedule k4key_s;
char *krb_get_phost();
static char *better_err_str[] = { "Server principal unrecognized by KDC",
"System clocks out of sync" };
#endif
#ifdef KRB5
krb5_data k5ap_req;
krb5_principal k5clientp, k5serverp;
krb5_creds k5in_creds, *k5out_creds;
krb5_timestamp now;
#endif
while (code || firsttime) {
#ifdef KRB4
if (scheme == HTAA_KERBEROS_V4) {
k4checksum = time(0) ^ getpid();
strcpy(phost, krb_get_phost(hostname));
code = krb_mk_req(&k4authent, "khttp", phost,
krb_realmofhost(hostname), k4checksum);
if (!code) { /* check for ticket expired */
code = krb_get_cred("khttp",phost,krb_realmofhost(hostname),&k4c);
if (!code) {
k4c.issue_date += ((unsigned char) k4c.lifetime) * 5 * 60;
if (time(0) >= k4c.issue_date) {
code=26;
}
}
}
if (!code) {
strcpy(user,k4c.pname);
pass = kdata_to_str(k4authent.dat, k4authent.length);
}
else if (code == 1) { /* normally "Principal Expired" */
strcpy(krb_err_str, better_err_str[0]);
}
else if (code == RD_AP_TIME) {
strcpy(krb_err_str, better_err_str[1]);
}
else {
strcpy(krb_err_str, krb_err_txt[code]);
}
}
#endif
#ifdef KRB5
if (scheme == HTAA_KERBEROS_V5) {
krb_err_str[0] = '\0';
if (!k5context) {
krb5_init_context(&k5context);
if (code) {
sprintf(krb_err_str,"Error initializing Kerb5 context: %s\n",error_message(code));
application_user_info_wait(krb_err_str);
return (char *) NULL;
}
krb5_init_ets(k5context);
code = krb5_cc_default(k5context, &k5ccache);
if (code) {
sprintf(krb_err_str,"Error initializing Credentials Cache: %s\n",error_message(code));
application_user_info_wait(krb_err_str);
return (char *) NULL;
}
}
code = krb5_mk_req(k5context, &k5auth_context, AP_OPTS_USE_SESSION_KEY,
"khttp", hostname, NULL, k5ccache, &k5ap_req);
if (!code) {
/* get username from credentials cache */
code = krb5_cc_get_principal(k5context, k5ccache, &k5clientp);
if (code) {
sprintf(krb_err_str,"Error getting client principal: %s\n",error_message(code));
application_user_info_wait(krb_err_str);
return (char *) NULL;
}
strcpy(user, k5clientp->data->data);
/* get server credentials to check for expiration */
code = krb5_timeofday(k5context, &now);
if (code) {
sprintf(krb_err_str,"Couldn't give ya the time of day: %s\n",error_message(code));
application_user_info_wait(krb_err_str);
return (char *) NULL;
}
krb5_sname_to_principal(k5context, hostname, "khttp",
KRB5_NT_SRV_HST, &k5serverp);
memset((char *)&k5in_creds, 0, sizeof(k5in_creds));
k5in_creds.server = k5serverp;
k5in_creds.client = k5clientp;
k5in_creds.times.endtime = now + KRB5_DEFAULT_LIFE;
k5in_creds.keyblock.keytype = 0;
k5in_creds.authdata = NULL;
code = krb5_get_credentials(k5context,KRB5_GC_CACHED,k5ccache,&k5in_creds,&k5out_creds);
if ((code == KRB5_CC_NOTFOUND) || (now >= k5out_creds->times.endtime)) {
/* replace "Matching creds not found" */
sprintf(krb_err_str,"Kerberos ticket expired\n");
code = 666;
}
krb5_free_cred_contents(k5context, &k5in_creds);
krb5_free_cred_contents(k5context, &k5out_creds);
krb5_free_principal(k5context, k5clientp);
krb5_free_principal(k5context, k5serverp);
}
if (code) {
if (!krb_err_str[0]) {
sprintf(krb_err_str,"krb5_mk_req: %s\n",error_message(code));
}
}
else {
pass = kdata_to_str(k5ap_req.data, k5ap_req.length);
}
}
#endif
if (code) {
sprintf(buf,"Error: %s\n\nWould you like to attempt to login\nto obtain a ticket-granting ticket?\n",krb_err_str);
if (!prompt_for_yes_or_no(buf)) {
return (char *) NULL;
}
else {
if (scheme_login(scheme))
return (char *) NULL;
}
} /* if (code) */
firsttime = 0;
} /* while (code || firsttime) */
if (!pass) {
sprintf(buf,"Error: Couldn't convert kdata to string (out of memory)\nAborting...\n");
application_user_info_wait(buf);
return (char *) NULL;
}
if (!tmp)
tmp = malloc(strlen(pass)+strlen(user)+40);
else
tmp = realloc(tmp, strlen(pass)+strlen(user)+40);
if (!tmp) {
/* XXX out of memory */
fprintf(stderr,"out of memory!!\n");
fflush(stderr);
exit(1);
}
doing_kerb_auth = 1;
strcpy(Hostname, hostname);
sprintf(tmp, "%s %s", user, pass);
free(pass);
return tmp;
}
/*************************************************************************
* validate_kerberos_server_auth
* Accepts: scheme (one of the HTAA_KERBEROS values)
* the Authorization line from the request
* Returns: NIL on success, T on failure
(currently return value not used)
************************************************************************/
int validate_kerberos_server_auth(scheme, str)
HTAAScheme scheme;
char *str;
{
int retval;
char buf[256], *tmp;
if (!doing_kerb_auth) {
/* sprintf(buf, "Received kerberos credentials from server %s, but I'm not doing kerberos authentication!\n", Hostname);
application_user_info_wait(buf);
*/
return 1;
}
if (*str != '[') {
fprintf(stderr,"\n\nleft bracket not found: [%s]\n",str);
goto krb_server_validate_getout;
}
if (tmp = index(str, ' ')) *tmp = NULL;
tmp = str + strlen(str) - 1;
if (*tmp != ']') {
fprintf(stderr,"\n\nright bracket not found\n\n");
goto krb_server_validate_getout;
}
*tmp = 0; /* end string where right bracket was */
str++; /* get rid of left bracket */
if (0) { /* just to get things started */
}
#ifdef KRB4
else if (scheme == HTAA_KERBEROS_V4) {
retval = k4validate_kerberos_server_auth(str);
}
#endif
#ifdef KRB5
else if (scheme == HTAA_KERBEROS_V5) {
retval = k5validate_kerberos_server_auth(str);
}
#endif
else {
retval = 1;
}
/* Reset stupid global state variables for the next auth we do. */
krb_server_validate_getout:
if (retval) {
sprintf(buf, " Warning:\nAuthentication of server %s failed", Hostname);
application_user_info_wait(buf);
}
/*
bzero(Hostname, sizeof(Hostname));
bzero(phost, sizeof(phost));
*/
memset(Hostname,0,sizeof(Hostname));
memset(phost,0,sizeof(phost));
doing_kerb_auth = 0;
return retval;
}
/************************************************************************/
#ifdef KRB4
int k4validate_kerberos_server_auth(str)
char *str;
{
KTEXT_ST k4authent;
CREDENTIALS k4cr;
Key_schedule k4key_s;
char buf[256];
k4authent.length = str_to_kdata(str, k4authent.dat);
if (k4authent.length == 0 || k4authent.length != 8) {
fprintf(stderr,"\n\nbad length\n\n");
return 1;
}
if (krb_get_cred("khttp", phost, krb_realmofhost(Hostname),&k4cr)) {
fprintf(stderr,"\n\ncouldn't get credentials");
return 1;
}
des_key_sched(k4cr.session, k4key_s);
des_ecb_encrypt(k4authent.dat, k4authent.dat, k4key_s, 0);
if (ntohl(*(long *)k4authent.dat) != k4checksum + 1) {
fprintf(stderr,"\n\nchecksum just doesn't check out\n\n");
return 1;
}
return 0;
}
#endif
/************************************************************************/
#ifdef KRB5
int k5validate_kerberos_server_auth(instr)
char *instr;
{
int code;
char buf[256];
char tmpstr[MAX_KDATA_LEN];
krb5_data k5ap_rep;
krb5_ap_rep_enc_part *k5ap_rep_result;
k5ap_rep.length = str_to_kdata(instr, tmpstr);
if (k5ap_rep.length == 0)
return 1;
k5ap_rep.data = tmpstr;
code = krb5_rd_rep(k5context, k5auth_context, &k5ap_rep, &k5ap_rep_result);
krb5_free_ap_rep_enc_part(k5context, k5ap_rep_result);
if (code)
return 1;
return 0;
}
#endif /* KRB5 */
/************************************************************************/
#endif /* KRB4 or KRB5 */