krb5_error_code
krb5_write_message(krb5_context context, krb5_pointer fdp, krb5_data *outbuf)
{
krb5_int32 len;
int fd = *( (int *) fdp);
len = htonl(outbuf->length);
if (krb5_net_write(context, fd, (char *)&len, 4) < 0) {
return(errno);
}
if (outbuf->length && (krb5_net_write(context, fd, outbuf->data, outbuf->length) < 0)) {
return(errno);
}
return(0);
}
ssize_t
do_write (int fd, void *buf, size_t sz, void *ivec)
{
if (do_encrypt) {
#ifdef KRB5
if(auth_method == AUTH_KRB5) {
krb5_error_code status;
krb5_data data;
unsigned char len[4];
int ret;
_krb5_put_int(len, sz, 4);
if(ivec != NULL) {
unsigned char *tmp = malloc(sz + 4);
if(tmp == NULL)
err(1, "malloc");
_krb5_put_int(tmp, sz, 4);
memcpy(tmp + 4, buf, sz);
status = krb5_encrypt_ivec(context, crypto, key_usage,
tmp, sz + 4, &data, ivec);
free(tmp);
} else
status = krb5_encrypt_ivec(context, crypto, key_usage,
buf, sz, &data, ivec);
if (status)
krb5_err(context, 1, status, "encrypting data");
ret = krb5_net_write (context, &fd, len, 4);
if (ret != 4)
return ret;
ret = krb5_net_write (context, &fd, data.data, data.length);
if (ret != data.length)
return ret;
free (data.data);
return sz;
} else
#endif /* KRB5 */
abort();
} else
return write (fd, buf, sz);
}
static int
proto (int sock, const char *hostname, const char *service)
{
krb5_auth_context auth_context;
krb5_error_code status;
krb5_principal server;
krb5_data data;
krb5_data packet;
u_int32_t len, net_len;
status = krb5_auth_con_init (context, &auth_context);
if (status)
krb5_err (context, 1, status, "krb5_auth_con_init");
status = krb5_auth_con_setaddrs_from_fd (context,
auth_context,
&sock);
if (status)
krb5_err (context, 1, status, "krb5_auth_con_setaddrs_from_fd");
status = krb5_sname_to_principal (context,
hostname,
service,
KRB5_NT_SRV_HST,
&server);
if (status)
krb5_err (context, 1, status, "krb5_sname_to_principal");
status = krb5_sendauth (context,
&auth_context,
&sock,
VERSION,
NULL,
server,
AP_OPTS_MUTUAL_REQUIRED,
NULL,
NULL,
NULL,
NULL,
NULL,
NULL);
if (status)
krb5_err (context, 1, status, "krb5_sendauth");
data.data = "hej";
data.length = 3;
krb5_data_zero (&packet);
status = krb5_mk_safe (context,
auth_context,
&data,
&packet,
NULL);
if (status)
krb5_err (context, 1, status, "krb5_mk_safe");
len = packet.length;
net_len = htonl(len);
if (krb5_net_write (context, &sock, &net_len, 4) != 4)
err (1, "krb5_net_write");
if (krb5_net_write (context, &sock, packet.data, len) != len)
err (1, "krb5_net_write");
data.data = "hemligt";
data.length = 7;
krb5_data_free (&packet);
status = krb5_mk_priv (context,
auth_context,
&data,
&packet,
NULL);
if (status)
krb5_err (context, 1, status, "krb5_mk_priv");
len = packet.length;
net_len = htonl(len);
if (krb5_net_write (context, &sock, &net_len, 4) != 4)
err (1, "krb5_net_write");
if (krb5_net_write (context, &sock, packet.data, len) != len)
err (1, "krb5_net_write");
return 0;
}
krb5_error_code KRB5_LIB_FUNCTION
krb5_sendauth(krb5_context context,
krb5_auth_context *auth_context,
krb5_pointer p_fd,
const char *appl_version,
krb5_principal client,
krb5_principal server,
krb5_flags ap_req_options,
krb5_data *in_data,
krb5_creds *in_creds,
krb5_ccache ccache,
krb5_error **ret_error,
krb5_ap_rep_enc_part **rep_result,
krb5_creds **out_creds)
{
krb5_error_code ret;
uint32_t len, net_len;
const char *version = KRB5_SENDAUTH_VERSION;
u_char repl;
krb5_data ap_req, error_data;
krb5_creds this_cred;
krb5_principal this_client = NULL;
krb5_creds *creds;
ssize_t sret;
krb5_boolean my_ccache = FALSE;
len = strlen(version) + 1;
net_len = htonl(len);
if (krb5_net_write (context, p_fd, &net_len, 4) != 4
|| krb5_net_write (context, p_fd, version, len) != len) {
ret = errno;
krb5_set_error_string (context, "write: %s", strerror(ret));
return ret;
}
len = strlen(appl_version) + 1;
net_len = htonl(len);
if (krb5_net_write (context, p_fd, &net_len, 4) != 4
|| krb5_net_write (context, p_fd, appl_version, len) != len) {
ret = errno;
krb5_set_error_string (context, "write: %s", strerror(ret));
return ret;
}
sret = krb5_net_read (context, p_fd, &repl, sizeof(repl));
if (sret < 0) {
ret = errno;
krb5_set_error_string (context, "read: %s", strerror(ret));
return ret;
} else if (sret != sizeof(repl)) {
krb5_clear_error_string (context);
return KRB5_SENDAUTH_BADRESPONSE;
}
if (repl != 0) {
krb5_clear_error_string (context);
return KRB5_SENDAUTH_REJECTED;
}
if (in_creds == NULL) {
if (ccache == NULL) {
ret = krb5_cc_default (context, &ccache);
if (ret)
return ret;
my_ccache = TRUE;
}
if (client == NULL) {
ret = krb5_cc_get_principal (context, ccache, &this_client);
if (ret) {
if(my_ccache)
krb5_cc_close(context, ccache);
return ret;
}
client = this_client;
}
memset(&this_cred, 0, sizeof(this_cred));
this_cred.client = client;
this_cred.server = server;
this_cred.times.endtime = 0;
this_cred.ticket.length = 0;
in_creds = &this_cred;
}
if (in_creds->ticket.length == 0) {
ret = krb5_get_credentials (context, 0, ccache, in_creds, &creds);
if (ret) {
if(my_ccache)
krb5_cc_close(context, ccache);
return ret;
}
} else {
creds = in_creds;
}
if(my_ccache)
krb5_cc_close(context, ccache);
ret = krb5_mk_req_extended (context,
auth_context,
ap_req_options,
in_data,
creds,
&ap_req);
if (out_creds)
*out_creds = creds;
else
krb5_free_creds(context, creds);
if(this_client)
krb5_free_principal(context, this_client);
if (ret)
return ret;
ret = krb5_write_message (context,
p_fd,
&ap_req);
if (ret)
return ret;
krb5_data_free (&ap_req);
ret = krb5_read_message (context, p_fd, &error_data);
if (ret)
return ret;
if (error_data.length != 0) {
KRB_ERROR error;
ret = krb5_rd_error (context, &error_data, &error);
krb5_data_free (&error_data);
if (ret == 0) {
ret = krb5_error_from_rd_error(context, &error, NULL);
if (ret_error != NULL) {
*ret_error = malloc (sizeof(krb5_error));
if (*ret_error == NULL) {
krb5_free_error_contents (context, &error);
} else {
**ret_error = error;
}
} else {
krb5_free_error_contents (context, &error);
}
return ret;
} else {
krb5_clear_error_string(context);
return ret;
}
}
if (ap_req_options & AP_OPTS_MUTUAL_REQUIRED) {
krb5_data ap_rep;
krb5_ap_rep_enc_part *ignore;
krb5_data_zero (&ap_rep);
ret = krb5_read_message (context,
p_fd,
&ap_rep);
if (ret)
return ret;
ret = krb5_rd_rep (context, *auth_context, &ap_rep,
rep_result ? rep_result : &ignore);
krb5_data_free (&ap_rep);
if (ret)
return ret;
if (rep_result == NULL)
krb5_free_ap_rep_enc_part (context, ignore);
}
return 0;
}
/**
* Perform the server side of the sendauth protocol like krb5_recvauth(), but support
* a user-specified callback, \a match_appl_version, to perform the match of the application
* version \a match_data.
*/
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_recvauth_match_version(krb5_context context,
krb5_auth_context *auth_context,
krb5_pointer p_fd,
krb5_boolean (*match_appl_version)(const void *,
const char*),
const void *match_data,
krb5_principal server,
int32_t flags,
krb5_keytab keytab,
krb5_ticket **ticket)
{
krb5_error_code ret;
const char *version = KRB5_SENDAUTH_VERSION;
char her_version[sizeof(KRB5_SENDAUTH_VERSION)];
char *her_appl_version;
uint32_t len;
u_char repl;
krb5_data data;
krb5_flags ap_options;
ssize_t n;
/*
* If there are no addresses in auth_context, get them from `fd'.
*/
if (*auth_context == NULL) {
ret = krb5_auth_con_init (context, auth_context);
if (ret)
return ret;
}
ret = krb5_auth_con_setaddrs_from_fd (context,
*auth_context,
p_fd);
if (ret)
return ret;
/*
* Expect SENDAUTH protocol version.
*/
if(!(flags & KRB5_RECVAUTH_IGNORE_VERSION)) {
n = krb5_net_read (context, p_fd, &len, 4);
if (n < 0) {
ret = errno;
krb5_set_error_message(context, ret, "read: %s", strerror(ret));
return ret;
}
if (n == 0) {
krb5_set_error_message(context, KRB5_SENDAUTH_BADAUTHVERS,
N_("Failed to receive sendauth data", ""));
return KRB5_SENDAUTH_BADAUTHVERS;
}
len = ntohl(len);
if (len != sizeof(her_version)
|| krb5_net_read (context, p_fd, her_version, len) != len
|| strncmp (version, her_version, len)) {
repl = 1;
krb5_net_write (context, p_fd, &repl, 1);
krb5_clear_error_message (context);
return KRB5_SENDAUTH_BADAUTHVERS;
}
}
/*
* Expect application protocol version.
*/
n = krb5_net_read (context, p_fd, &len, 4);
if (n < 0) {
ret = errno;
krb5_set_error_message(context, ret, "read: %s", strerror(ret));
return ret;
}
if (n == 0) {
krb5_clear_error_message (context);
return KRB5_SENDAUTH_BADAPPLVERS;
}
len = ntohl(len);
her_appl_version = malloc (len);
if (her_appl_version == NULL) {
repl = 2;
krb5_net_write (context, p_fd, &repl, 1);
krb5_set_error_message(context, ENOMEM,
N_("malloc: out of memory", ""));
return ENOMEM;
}
if (krb5_net_read (context, p_fd, her_appl_version, len) != len
|| !(*match_appl_version)(match_data, her_appl_version)) {
repl = 2;
krb5_net_write (context, p_fd, &repl, 1);
krb5_set_error_message(context, KRB5_SENDAUTH_BADAPPLVERS,
N_("wrong sendauth application version (%s)", ""),
her_appl_version);
free (her_appl_version);
return KRB5_SENDAUTH_BADAPPLVERS;
}
free (her_appl_version);
/*
* Send OK.
*/
repl = 0;
if (krb5_net_write (context, p_fd, &repl, 1) != 1) {
ret = errno;
krb5_set_error_message(context, ret, "write: %s", strerror(ret));
return ret;
}
/*
* Until here, the fields in the message were in cleartext and unauthenticated.
* From now on, Kerberos kicks in.
*/
/*
* Expect AP_REQ.
*/
krb5_data_zero (&data);
ret = krb5_read_message (context, p_fd, &data);
if (ret)
return ret;
ret = krb5_rd_req (context,
auth_context,
&data,
server,
keytab,
&ap_options,
ticket);
krb5_data_free (&data);
if (ret) {
krb5_data error_data;
krb5_error_code ret2;
ret2 = krb5_mk_error (context,
ret,
NULL,
NULL,
NULL,
server,
NULL,
NULL,
&error_data);
if (ret2 == 0) {
krb5_write_message (context, p_fd, &error_data);
krb5_data_free (&error_data);
}
return ret;
}
/*
* Send OK.
*/
len = 0;
if (krb5_net_write (context, p_fd, &len, 4) != 4) {
ret = errno;
krb5_set_error_message(context, ret, "write: %s", strerror(ret));
krb5_free_ticket(context, *ticket);
*ticket = NULL;
return ret;
}
/*
* If client requires mutual authentication, send AP_REP.
*/
if (ap_options & AP_OPTS_MUTUAL_REQUIRED) {
ret = krb5_mk_rep (context, *auth_context, &data);
if (ret) {
krb5_free_ticket(context, *ticket);
*ticket = NULL;
return ret;
}
ret = krb5_write_message (context, p_fd, &data);
if (ret) {
krb5_free_ticket(context, *ticket);
*ticket = NULL;
return ret;
}
krb5_data_free (&data);
}
return 0;
}
krb5_error_code KRB5_LIB_FUNCTION
krb5_recvauth_match_version(krb5_context context,
krb5_auth_context *auth_context,
krb5_pointer p_fd,
krb5_boolean (*match_appl_version)(const void *,
const char*),
const void *match_data,
krb5_principal server,
int32_t flags,
krb5_keytab keytab,
krb5_ticket **ticket)
{
krb5_error_code ret;
const char *version = KRB5_SENDAUTH_VERSION;
char her_version[sizeof(KRB5_SENDAUTH_VERSION)];
char *her_appl_version;
u_int32_t len;
u_char repl;
krb5_data data;
krb5_flags ap_options;
ssize_t n;
/*
* If there are no addresses in auth_context, get them from `fd'.
*/
if (*auth_context == NULL) {
ret = krb5_auth_con_init (context, auth_context);
if (ret)
return ret;
}
ret = krb5_auth_con_setaddrs_from_fd (context,
*auth_context,
p_fd);
if (ret)
return ret;
if(!(flags & KRB5_RECVAUTH_IGNORE_VERSION)) {
n = krb5_net_read (context, p_fd, &len, 4);
if (n < 0) {
ret = errno;
krb5_set_error_string (context, "read: %s", strerror(errno));
return ret;
}
if (n == 0) {
krb5_clear_error_string (context);
return KRB5_SENDAUTH_BADAUTHVERS;
}
len = ntohl(len);
if (len != sizeof(her_version)
|| krb5_net_read (context, p_fd, her_version, len) != len
|| strncmp (version, her_version, len)) {
repl = 1;
krb5_net_write (context, p_fd, &repl, 1);
krb5_clear_error_string (context);
return KRB5_SENDAUTH_BADAUTHVERS;
}
}
n = krb5_net_read (context, p_fd, &len, 4);
if (n < 0) {
ret = errno;
krb5_set_error_string (context, "read: %s", strerror(errno));
return ret;
}
if (n == 0) {
krb5_clear_error_string (context);
return KRB5_SENDAUTH_BADAPPLVERS;
}
len = ntohl(len);
her_appl_version = malloc (len);
if (her_appl_version == NULL) {
repl = 2;
krb5_net_write (context, p_fd, &repl, 1);
krb5_set_error_string (context, "malloc: out of memory");
return ENOMEM;
}
if (krb5_net_read (context, p_fd, her_appl_version, len) != len
|| !(*match_appl_version)(match_data, her_appl_version)) {
repl = 2;
krb5_net_write (context, p_fd, &repl, 1);
krb5_set_error_string (context, "wrong sendauth version (%s)",
her_appl_version);
free (her_appl_version);
return KRB5_SENDAUTH_BADAPPLVERS;
}
free (her_appl_version);
repl = 0;
if (krb5_net_write (context, p_fd, &repl, 1) != 1) {
ret = errno;
krb5_set_error_string (context, "write: %s", strerror(errno));
return ret;
}
krb5_data_zero (&data);
ret = krb5_read_message (context, p_fd, &data);
if (ret)
return ret;
ret = krb5_rd_req (context,
auth_context,
&data,
server,
keytab,
&ap_options,
ticket);
krb5_data_free (&data);
if (ret) {
krb5_data error_data;
krb5_error_code ret2;
ret2 = krb5_mk_error (context,
ret,
NULL,
NULL,
NULL,
server,
NULL,
NULL,
&error_data);
if (ret2 == 0) {
krb5_write_message (context, p_fd, &error_data);
krb5_data_free (&error_data);
}
return ret;
}
len = 0;
if (krb5_net_write (context, p_fd, &len, 4) != 4) {
ret = errno;
krb5_set_error_string (context, "write: %s", strerror(errno));
return ret;
}
if (ap_options & AP_OPTS_MUTUAL_REQUIRED) {
ret = krb5_mk_rep (context, *auth_context, &data);
if (ret)
return ret;
ret = krb5_write_message (context, p_fd, &data);
if (ret)
return ret;
krb5_data_free (&data);
}
return 0;
}
