long
Leash_convert524(
krb5_context alt_ctx
)
{
#if defined(NO_KRB5) || defined(NO_KRB4)
return(0);
#else
krb5_context ctx = 0;
krb5_error_code code = 0;
int icode = 0;
krb5_principal me = 0;
krb5_principal server = 0;
krb5_creds *v5creds = 0;
krb5_creds increds;
krb5_ccache cc = 0;
CREDENTIALS * v4creds = NULL;
static int init_ets = 1;
if (!pkrb5_init_context ||
!pkrb_in_tkt ||
!pkrb524_init_ets ||
!pkrb524_convert_creds_kdc)
return 0;
v4creds = (CREDENTIALS *) malloc(sizeof(CREDENTIALS));
memset((char *) v4creds, 0, sizeof(CREDENTIALS));
memset((char *) &increds, 0, sizeof(increds));
/*
From this point on, we can goto cleanup because increds is
initialized.
*/
if (alt_ctx)
{
ctx = alt_ctx;
}
else
{
code = pkrb5_init_context(&ctx);
if (code) goto cleanup;
}
code = pkrb5_cc_default(ctx, &cc);
if (code) goto cleanup;
if ( init_ets ) {
pkrb524_init_ets(ctx);
init_ets = 0;
}
if (code = pkrb5_cc_get_principal(ctx, cc, &me))
goto cleanup;
if ((code = pkrb5_build_principal(ctx,
&server,
krb5_princ_realm(ctx, me)->length,
krb5_princ_realm(ctx, me)->data,
"krbtgt",
krb5_princ_realm(ctx, me)->data,
NULL))) {
goto cleanup;
}
increds.client = me;
increds.server = server;
increds.times.endtime = 0;
increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
if ((code = pkrb5_get_credentials(ctx, 0,
cc,
&increds,
&v5creds))) {
goto cleanup;
}
if ((icode = pkrb524_convert_creds_kdc(ctx,
v5creds,
v4creds))) {
goto cleanup;
}
/* initialize ticket cache */
if ((icode = pkrb_in_tkt(v4creds->pname, v4creds->pinst, v4creds->realm)
!= KSUCCESS)) {
goto cleanup;
}
/* stash ticket, session key, etc. for future use */
if ((icode = pkrb_save_credentials(v4creds->service,
v4creds->instance,
v4creds->realm,
v4creds->session,
v4creds->lifetime,
v4creds->kvno,
&(v4creds->ticket_st),
v4creds->issue_date))) {
goto cleanup;
}
cleanup:
memset(v4creds, 0, sizeof(v4creds));
free(v4creds);
if (v5creds) {
pkrb5_free_creds(ctx, v5creds);
}
if (increds.client == me)
me = 0;
if (increds.server == server)
server = 0;
pkrb5_free_cred_contents(ctx, &increds);
if (server) {
pkrb5_free_principal(ctx, server);
}
if (me) {
pkrb5_free_principal(ctx, me);
}
pkrb5_cc_close(ctx, cc);
if (ctx && (ctx != alt_ctx)) {
pkrb5_free_context(ctx);
}
return !(code || icode);
#endif /* NO_KRB5 */
}
int
Leash_afs_klog(
char *service,
char *cell,
char *realm,
int LifeTime
)
{
/////#ifdef NO_AFS
#if defined(NO_AFS) || defined(NO_KRB4)
return(0);
#else
long rc;
////This is defined in krb.h:
CREDENTIALS creds;
KTEXT_ST ticket;
struct ktc_principal aserver;
struct ktc_principal aclient;
char realm_of_user[REALM_SZ]; /* Kerberos realm of user */
char realm_of_cell[REALM_SZ]; /* Kerberos realm of cell */
char local_cell[MAXCELLCHARS+1];
char Dmycell[MAXCELLCHARS+1];
struct ktc_token atoken;
struct ktc_token btoken;
afsconf_cell ak_cellconfig; /* General information about the cell */
char RealmName[128];
char CellName[128];
char ServiceName[128];
DWORD CurrentState;
char HostName[64];
BOOL try_krb5 = 0;
int retry = 0;
int len;
#ifndef NO_KRB5
krb5_context context = 0;
krb5_ccache _krb425_ccache = 0;
krb5_creds increds;
krb5_creds * k5creds = 0;
krb5_error_code r;
krb5_principal client_principal = 0;
krb5_flags flags = 0;
#endif /* NO_KRB5 */
if (!AfsAvailable || GetAfsStatus(&AfsOnLine) && !AfsOnLine)
return(0);
if ( !realm ) realm = "";
if ( !cell ) cell = "";
if ( !service ) service = "";
CurrentState = 0;
memset(HostName, '\0', sizeof(HostName));
gethostname(HostName, sizeof(HostName));
if (GetServiceStatus(HostName, TRANSARCAFSDAEMON, &CurrentState) != NOERROR)
return(0);
if (CurrentState != SERVICE_RUNNING)
return(0);
memset(RealmName, '\0', sizeof(RealmName));
memset(CellName, '\0', sizeof(CellName));
memset(ServiceName, '\0', sizeof(ServiceName));
memset(realm_of_user, '\0', sizeof(realm_of_user));
memset(realm_of_cell, '\0', sizeof(realm_of_cell));
memset(Dmycell, '\0', sizeof(Dmycell));
// NULL or empty cell returns information on local cell
if (cell && cell[0])
strcpy(Dmycell, cell);
rc = get_cellconfig(Dmycell, &ak_cellconfig, local_cell);
if (rc && cell && cell[0]) {
memset(Dmycell, '\0', sizeof(Dmycell));
rc = get_cellconfig(Dmycell, &ak_cellconfig, local_cell);
}
if (rc)
return(rc);
#ifndef NO_KRB5
if (!(r = Leash_krb5_initialize(&context, &_krb425_ccache))) {
int i;
memset((char *)&increds, 0, sizeof(increds));
(*pkrb5_cc_get_principal)(context, _krb425_ccache, &client_principal);
i = krb5_princ_realm(context, client_principal)->length;
if (i > REALM_SZ-1)
i = REALM_SZ-1;
strncpy(realm_of_user,krb5_princ_realm(context, client_principal)->data,i);
realm_of_user[i] = 0;
try_krb5 = 1;
}
#endif /* NO_KRB5 */
#ifndef NO_KRB4
if ( !try_krb5 || !realm_of_user[0] ) {
if ((rc = (*pkrb_get_tf_realm)((*ptkt_string)(), realm_of_user)) != KSUCCESS)
{
return(rc);
}
}
#endif
strcpy(realm_of_cell, afs_realm_of_cell(&ak_cellconfig));
if (strlen(service) == 0)
strcpy(ServiceName, "afs");
else
strcpy(ServiceName, service);
if (strlen(cell) == 0)
strcpy(CellName, local_cell);
else
strcpy(CellName, cell);
if (strlen(realm) == 0)
strcpy(RealmName, realm_of_cell);
else
strcpy(RealmName, realm);
memset(&creds, '\0', sizeof(creds));
#ifndef NO_KRB5
if ( try_krb5 ) {
/* First try Service/Cell@REALM */
if (r = (*pkrb5_build_principal)(context, &increds.server,
strlen(RealmName),
RealmName,
ServiceName,
CellName,
0))
{
try_krb5 = 0;
goto use_krb4;
}
increds.client = client_principal;
increds.times.endtime = 0;
/* Ask for DES since that is what V4 understands */
increds.keyblock.enctype = ENCTYPE_DES_CBC_CRC;
#ifdef KRB5_TC_NOTICKET
flags = 0;
r = pkrb5_cc_set_flags(context, _krb425_ccache, flags);
#endif
if (r == 0)
r = pkrb5_get_credentials(context, 0, _krb425_ccache, &increds, &k5creds);
if (r == KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN ||
r == KRB5KRB_ERR_GENERIC /* Heimdal */) {
/* Next try Service@REALM */
pkrb5_free_principal(context, increds.server);
r = pkrb5_build_principal(context, &increds.server,
strlen(RealmName),
RealmName,
ServiceName,
0);
if (r == 0)
r = pkrb5_get_credentials(context, 0, _krb425_ccache, &increds, &k5creds);
}
pkrb5_free_principal(context, increds.server);
pkrb5_free_principal(context, client_principal);
#ifdef KRB5_TC_NOTICKET
flags = KRB5_TC_NOTICKET;
pkrb5_cc_set_flags(context, _krb425_ccache, flags);
#endif
(void) pkrb5_cc_close(context, _krb425_ccache);
_krb425_ccache = 0;
if (r || k5creds == 0) {
pkrb5_free_context(context);
try_krb5 = 0;
goto use_krb4;
}
/* This code inserts the entire K5 ticket into the token
* No need to perform a krb524 translation which is
* commented out in the code below
*/
if ( use_krb524() || k5creds->ticket.length > MAXKTCTICKETLEN )
goto try_krb524d;
memset(&aserver, '\0', sizeof(aserver));
strncpy(aserver.name, ServiceName, MAXKTCNAMELEN - 1);
strncpy(aserver.cell, CellName, MAXKTCREALMLEN - 1);
memset(&atoken, '\0', sizeof(atoken));
atoken.kvno = RXKAD_TKT_TYPE_KERBEROS_V5;
atoken.startTime = k5creds->times.starttime;
atoken.endTime = k5creds->times.endtime;
memcpy(&atoken.sessionKey, k5creds->keyblock.contents, k5creds->keyblock.length);
atoken.ticketLen = k5creds->ticket.length;
memcpy(atoken.ticket, k5creds->ticket.data, atoken.ticketLen);
retry_gettoken5:
rc = ktc_GetToken(&aserver, &btoken, sizeof(btoken), &aclient);
if (rc != 0 && rc != KTC_NOENT && rc != KTC_NOCELL) {
if ( rc == KTC_NOCM && retry < 20 ) {
Sleep(500);
retry++;
goto retry_gettoken5;
}
goto try_krb524d;
}
if (atoken.kvno == btoken.kvno &&
atoken.ticketLen == btoken.ticketLen &&
!memcmp(&atoken.sessionKey, &btoken.sessionKey, sizeof(atoken.sessionKey)) &&
!memcmp(atoken.ticket, btoken.ticket, atoken.ticketLen))
{
/* Success */
pkrb5_free_creds(context, k5creds);
pkrb5_free_context(context);
return(0);
}
// * Reset the "aclient" structure before we call ktc_SetToken.
// * This structure was first set by the ktc_GetToken call when
// * we were comparing whether identical tokens already existed.
len = min(k5creds->client->data[0].length,MAXKTCNAMELEN - 1);
strncpy(aclient.name, k5creds->client->data[0].data, len);
aclient.name[len] = '\0';
if ( k5creds->client->length > 1 ) {
char * p;
strcat(aclient.name, ".");
p = aclient.name + strlen(aclient.name);
len = min(k5creds->client->data[1].length,MAXKTCNAMELEN - strlen(aclient.name) - 1);
strncpy(p, k5creds->client->data[1].data, len);
p[len] = '\0';
}
aclient.instance[0] = '\0';
strcpy(aclient.cell, realm_of_cell);
len = min(k5creds->client->realm.length,strlen(realm_of_cell));
if ( strncmp(realm_of_cell, k5creds->client->realm.data, len) ) {
char * p;
strcat(aclient.name, "@");
p = aclient.name + strlen(aclient.name);
len = min(k5creds->client->realm.length,MAXKTCNAMELEN - strlen(aclient.name) - 1);
strncpy(p, k5creds->client->realm.data, len);
p[len] = '\0';
}
rc = ktc_SetToken(&aserver, &atoken, &aclient, 0);
if (!rc) {
/* Success */
pkrb5_free_creds(context, k5creds);
pkrb5_free_context(context);
return(0);
}
try_krb524d:
/* This requires krb524d to be running with the KDC */
r = pkrb524_convert_creds_kdc(context, k5creds, &creds);
pkrb5_free_creds(context, k5creds);
pkrb5_free_context(context);
if (r) {
try_krb5 = 0;
goto use_krb4;
}
rc = KSUCCESS;
} else
#endif /* NO_KRB5 */
{
use_krb4:
rc = KFAILURE;
}
if (rc != KSUCCESS)
{
return(rc);
}
memset(&aserver, '\0', sizeof(aserver));
strncpy(aserver.name, ServiceName, MAXKTCNAMELEN - 1);
strncpy(aserver.cell, CellName, MAXKTCNAMELEN - 1);
memset(&atoken, '\0', sizeof(atoken));
atoken.kvno = creds.kvno;
atoken.startTime = creds.issue_date;
atoken.endTime = (*pkrb_life_to_time)(creds.issue_date,creds.lifetime);
memcpy(&atoken.sessionKey, creds.session, 8);
atoken.ticketLen = creds.ticket_st.length;
memcpy(atoken.ticket, creds.ticket_st.dat, atoken.ticketLen);
if (!(rc = ktc_GetToken(&aserver, &btoken, sizeof(btoken), &aclient)) &&
atoken.kvno == btoken.kvno &&
atoken.ticketLen == btoken.ticketLen &&
!memcmp(&atoken.sessionKey, &btoken.sessionKey, sizeof(atoken.sessionKey)) &&
!memcmp(atoken.ticket, btoken.ticket, atoken.ticketLen))
{
return(0);
}
// * Reset the "aclient" structure before we call ktc_SetToken.
// * This structure was first set by the ktc_GetToken call when
// * we were comparing whether identical tokens already existed.
strncpy(aclient.name, creds.pname, MAXKTCNAMELEN - 1);
aclient.name[MAXKTCNAMELEN - 1] = '\0';
if (creds.pinst[0])
{
strncat(aclient.name, ".", MAXKTCNAMELEN - 1 - strlen(aclient.name));
aclient.name[MAXKTCNAMELEN - 1] = '\0';
strncat(aclient.name, creds.pinst, MAXKTCNAMELEN - 1 - strlen(aclient.name));
aclient.name[MAXKTCNAMELEN - 1] = '\0';
}
strcpy(aclient.instance, "");
if ( strcmp(realm_of_cell, creds.realm) )
{
strncat(aclient.name, "@", MAXKTCNAMELEN - 1 - strlen(aclient.name));
aclient.name[MAXKTCNAMELEN - 1] = '\0';
strncat(aclient.name, creds.realm, MAXKTCNAMELEN - 1 - strlen(aclient.name));
aclient.name[MAXKTCNAMELEN - 1] = '\0';
}
aclient.name[MAXKTCNAMELEN-1] = '\0';
strcpy(aclient.cell, CellName);
// * NOTE: On WIN32, the order of SetToken params changed...
// * to ktc_SetToken(&aserver, &aclient, &atoken, 0)
// * from ktc_SetToken(&aserver, &atoken, &aclient, 0) on Unix...
// * The afscompat ktc_SetToken provides the Unix order
if (rc = ktc_SetToken(&aserver, &atoken, &aclient, 0))
{
Leash_afs_error(rc, "ktc_SetToken()");
return(rc);
}
return(0);
#endif
}