[BACK]Return to auth-krb4.c CVS log [TXT][DIR] Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/Attic/auth-krb4.c between version 1.8 and 1.9

version 1.8, 1999/11/15 00:42:00 version 1.9, 1999/11/23 22:25:52
Line 20 
Line 20 
 void  void
 krb4_cleanup_proc(void *ignore)  krb4_cleanup_proc(void *ignore)
 {  {
   debug("krb4_cleanup_proc called");          debug("krb4_cleanup_proc called");
           if (ticket) {
   if (ticket) {                  (void) dest_tkt();
     (void) dest_tkt();                  xfree(ticket);
     xfree(ticket);                  ticket = NULL;
     ticket = NULL;          }
   }  
 }  }
   
 int krb4_init(uid_t uid)  int
   krb4_init(uid_t uid)
 {  {
   static int cleanup_registered = 0;          static int cleanup_registered = 0;
   char *tkt_root = TKT_ROOT;          char *tkt_root = TKT_ROOT;
   struct stat st;          struct stat st;
   int fd;          int fd;
   
   if (!ticket) {          if (!ticket) {
     /* Set unique ticket string manually since we're still root. */                  /* Set unique ticket string manually since we're still root. */
     ticket = xmalloc(MAXPATHLEN);                  ticket = xmalloc(MAXPATHLEN);
 #ifdef AFS  #ifdef AFS
     if (lstat("/ticket", &st) != -1)                  if (lstat("/ticket", &st) != -1)
       tkt_root = "/ticket/";                          tkt_root = "/ticket/";
 #endif /* AFS */  #endif /* AFS */
     snprintf(ticket, MAXPATHLEN, "%s%d_%d", tkt_root, uid, getpid());                  snprintf(ticket, MAXPATHLEN, "%s%d_%d", tkt_root, uid, getpid());
     (void) krb_set_tkt_string(ticket);                  (void) krb_set_tkt_string(ticket);
   }          }
   /* Register ticket cleanup in case of fatal error. */          /* Register ticket cleanup in case of fatal error. */
   if (!cleanup_registered) {          if (!cleanup_registered) {
     fatal_add_cleanup(krb4_cleanup_proc, NULL);                  fatal_add_cleanup(krb4_cleanup_proc, NULL);
     cleanup_registered = 1;                  cleanup_registered = 1;
   }          }
   /* Try to create our ticket file. */          /* Try to create our ticket file. */
   if ((fd = mkstemp(ticket)) != -1) {          if ((fd = mkstemp(ticket)) != -1) {
     close(fd);                  close(fd);
     return 1;                  return 1;
   }          }
   /* Ticket file exists - make sure user owns it (just passed ticket). */          /* Ticket file exists - make sure user owns it (just passed ticket). */
   if (lstat(ticket, &st) != -1) {          if (lstat(ticket, &st) != -1) {
     if (st.st_mode == (S_IFREG|S_IRUSR|S_IWUSR) && st.st_uid == uid)                  if (st.st_mode == (S_IFREG | S_IRUSR | S_IWUSR) &&
       return 1;                      st.st_uid == uid)
   }                          return 1;
   /* Failure - cancel cleanup function, leaving bad ticket for inspection. */          }
   log("WARNING: bad ticket file %s", ticket);          /* Failure - cancel cleanup function, leaving bad ticket for inspection. */
   fatal_remove_cleanup(krb4_cleanup_proc, NULL);          log("WARNING: bad ticket file %s", ticket);
   cleanup_registered = 0;          fatal_remove_cleanup(krb4_cleanup_proc, NULL);
   xfree(ticket);          cleanup_registered = 0;
   ticket = NULL;          xfree(ticket);
           ticket = NULL;
   return 0;  
           return 0;
 }  }
   
 int auth_krb4(const char *server_user, KTEXT auth, char **client)  int
   auth_krb4(const char *server_user, KTEXT auth, char **client)
 {  {
   AUTH_DAT adat   = { 0 };          AUTH_DAT adat = {0};
   KTEXT_ST reply;          KTEXT_ST reply;
   char instance[INST_SZ];          char instance[INST_SZ];
   int r, s;          int r, s;
   u_int cksum;          u_int cksum;
   Key_schedule schedule;          Key_schedule schedule;
   struct sockaddr_in local, foreign;          struct sockaddr_in local, foreign;
   
   s = packet_get_connection_in();  
   
   r = sizeof(local);  
   memset(&local, 0, sizeof(local));  
   if (getsockname(s, (struct sockaddr *) &local, &r) < 0)  
     debug("getsockname failed: %.100s", strerror(errno));  
   r = sizeof(foreign);  
   memset(&foreign, 0, sizeof(foreign));  
   if (getpeername(s, (struct sockaddr *)&foreign, &r) < 0) {  
     debug("getpeername failed: %.100s", strerror(errno));  
     fatal_cleanup();  
   }  
   
   instance[0] = '*'; instance[1] = 0;  
   
   /* Get the encrypted request, challenge, and session key. */  
   if ((r = krb_rd_req(auth, KRB4_SERVICE_NAME, instance, 0, &adat, ""))) {  
     packet_send_debug("Kerberos V4 krb_rd_req: %.100s", krb_err_txt[r]);  
     return 0;  
   }  
   des_key_sched((des_cblock *)adat.session, schedule);  
   
   *client = xmalloc(MAX_K_NAME_SZ);  
   (void) snprintf(*client, MAX_K_NAME_SZ, "%s%s%s@%s", adat.pname,  
                   *adat.pinst ? "." : "", adat.pinst, adat.prealm);  
   
   /* Check ~/.klogin authorization now. */          s = packet_get_connection_in();
   if (kuserok(&adat, (char *)server_user) != KSUCCESS) {  
     packet_send_debug("Kerberos V4 .klogin authorization failed!");          r = sizeof(local);
     log("Kerberos V4 .klogin authorization failed for %s to account %s",          memset(&local, 0, sizeof(local));
         *client, server_user);          if (getsockname(s, (struct sockaddr *) & local, &r) < 0)
     xfree(*client);                  debug("getsockname failed: %.100s", strerror(errno));
     return 0;          r = sizeof(foreign);
   }          memset(&foreign, 0, sizeof(foreign));
   /* Increment the checksum, and return it encrypted with the session key. */          if (getpeername(s, (struct sockaddr *) & foreign, &r) < 0) {
   cksum = adat.checksum + 1;                  debug("getpeername failed: %.100s", strerror(errno));
   cksum = htonl(cksum);                  fatal_cleanup();
           }
   /* If we can't successfully encrypt the checksum, we send back an empty          instance[0] = '*';
      message, admitting our failure. */          instance[1] = 0;
   if ((r = krb_mk_priv((u_char *)&cksum, reply.dat, sizeof(cksum)+1,  
                        schedule, &adat.session, &local, &foreign)) < 0) {          /* Get the encrypted request, challenge, and session key. */
     packet_send_debug("Kerberos V4 mk_priv: (%d) %s", r, krb_err_txt[r]);          if ((r = krb_rd_req(auth, KRB4_SERVICE_NAME, instance, 0, &adat, ""))) {
     reply.dat[0] = 0;                  packet_send_debug("Kerberos V4 krb_rd_req: %.100s", krb_err_txt[r]);
     reply.length = 0;                  return 0;
   }          }
   else reply.length = r;          des_key_sched((des_cblock *) adat.session, schedule);
   
   /* Clear session key. */          *client = xmalloc(MAX_K_NAME_SZ);
   memset(&adat.session, 0, sizeof(&adat.session));          (void) snprintf(*client, MAX_K_NAME_SZ, "%s%s%s@%s", adat.pname,
                           *adat.pinst ? "." : "", adat.pinst, adat.prealm);
   packet_start(SSH_SMSG_AUTH_KERBEROS_RESPONSE);  
   packet_put_string((char *) reply.dat, reply.length);          /* Check ~/.klogin authorization now. */
   packet_send();          if (kuserok(&adat, (char *) server_user) != KSUCCESS) {
   packet_write_wait();                  packet_send_debug("Kerberos V4 .klogin authorization failed!");
   return 1;                  log("Kerberos V4 .klogin authorization failed for %s to account %s",
                       *client, server_user);
                   xfree(*client);
                   return 0;
           }
           /* Increment the checksum, and return it encrypted with the
              session key. */
           cksum = adat.checksum + 1;
           cksum = htonl(cksum);
   
           /* If we can't successfully encrypt the checksum, we send back an
              empty message, admitting our failure. */
           if ((r = krb_mk_priv((u_char *) & cksum, reply.dat, sizeof(cksum) + 1,
                                schedule, &adat.session, &local, &foreign)) < 0) {
                   packet_send_debug("Kerberos V4 mk_priv: (%d) %s", r, krb_err_txt[r]);
                   reply.dat[0] = 0;
                   reply.length = 0;
           } else
                   reply.length = r;
   
           /* Clear session key. */
           memset(&adat.session, 0, sizeof(&adat.session));
   
           packet_start(SSH_SMSG_AUTH_KERBEROS_RESPONSE);
           packet_put_string((char *) reply.dat, reply.length);
           packet_send();
           packet_write_wait();
           return 1;
 }  }
 #endif /* KRB4 */  #endif /* KRB4 */
   
 #ifdef AFS  #ifdef AFS
 int auth_kerberos_tgt(struct passwd *pw, const char *string)  int
   auth_kerberos_tgt(struct passwd *pw, const char *string)
 {  {
   CREDENTIALS creds;          CREDENTIALS creds;
   
   if (!radix_to_creds(string, &creds)) {  
     log("Protocol error decoding Kerberos V4 tgt");  
     packet_send_debug("Protocol error decoding Kerberos V4 tgt");  
     goto auth_kerberos_tgt_failure;  
   }  
   if (strncmp(creds.service, "", 1) == 0) /* backward compatibility */  
     strlcpy(creds.service, "krbtgt", sizeof creds.service);  
   
   if (strcmp(creds.service, "krbtgt")) {  
     log("Kerberos V4 tgt (%s%s%s@%s) rejected for %s", creds.pname,  
         creds.pinst[0] ? "." : "", creds.pinst, creds.realm, pw->pw_name);  
     packet_send_debug("Kerberos V4 tgt (%s%s%s@%s) rejected for %s",  
                       creds.pname, creds.pinst[0] ? "." : "", creds.pinst,  
                       creds.realm, pw->pw_name);  
     goto auth_kerberos_tgt_failure;  
   }  
   if (!krb4_init(pw->pw_uid))  
     goto auth_kerberos_tgt_failure;  
   
   if (in_tkt(creds.pname, creds.pinst) != KSUCCESS)          if (!radix_to_creds(string, &creds)) {
     goto auth_kerberos_tgt_failure;                  log("Protocol error decoding Kerberos V4 tgt");
                   packet_send_debug("Protocol error decoding Kerberos V4 tgt");
   if (save_credentials(creds.service, creds.instance, creds.realm,                  goto auth_kerberos_tgt_failure;
                        creds.session, creds.lifetime, creds.kvno,          }
                        &creds.ticket_st, creds.issue_date) != KSUCCESS) {          if (strncmp(creds.service, "", 1) == 0) /* backward compatibility */
     packet_send_debug("Kerberos V4 tgt refused: couldn't save credentials");                  strlcpy(creds.service, "krbtgt", sizeof creds.service);
     goto auth_kerberos_tgt_failure;  
   }          if (strcmp(creds.service, "krbtgt")) {
   /* Successful authentication, passed all checks. */                  log("Kerberos V4 tgt (%s%s%s@%s) rejected for %s", creds.pname,
   chown(tkt_string(), pw->pw_uid, pw->pw_gid);                      creds.pinst[0] ? "." : "", creds.pinst, creds.realm, pw->pw_name);
                   packet_send_debug("Kerberos V4 tgt (%s%s%s@%s) rejected for %s",
   packet_send_debug("Kerberos V4 tgt accepted (%s.%s@%s, %s%s%s@%s)",                       creds.pname, creds.pinst[0] ? "." : "", creds.pinst,
                     creds.service, creds.instance, creds.realm, creds.pname,                                    creds.realm, pw->pw_name);
                     creds.pinst[0] ? "." : "", creds.pinst, creds.realm);                  goto auth_kerberos_tgt_failure;
   memset(&creds, 0, sizeof(creds));          }
   packet_start(SSH_SMSG_SUCCESS);          if (!krb4_init(pw->pw_uid))
   packet_send();                  goto auth_kerberos_tgt_failure;
   packet_write_wait();  
   return 1;          if (in_tkt(creds.pname, creds.pinst) != KSUCCESS)
                   goto auth_kerberos_tgt_failure;
  auth_kerberos_tgt_failure:  
   krb4_cleanup_proc(NULL);          if (save_credentials(creds.service, creds.instance, creds.realm,
   memset(&creds, 0, sizeof(creds));                               creds.session, creds.lifetime, creds.kvno,
   packet_start(SSH_SMSG_FAILURE);                               &creds.ticket_st, creds.issue_date) != KSUCCESS) {
   packet_send();                  packet_send_debug("Kerberos V4 tgt refused: couldn't save credentials");
   packet_write_wait();                  goto auth_kerberos_tgt_failure;
   return 0;          }
           /* Successful authentication, passed all checks. */
           chown(tkt_string(), pw->pw_uid, pw->pw_gid);
   
           packet_send_debug("Kerberos V4 tgt accepted (%s.%s@%s, %s%s%s@%s)",
                             creds.service, creds.instance, creds.realm, creds.pname,
                             creds.pinst[0] ? "." : "", creds.pinst, creds.realm);
           memset(&creds, 0, sizeof(creds));
           packet_start(SSH_SMSG_SUCCESS);
           packet_send();
           packet_write_wait();
           return 1;
   
   auth_kerberos_tgt_failure:
           krb4_cleanup_proc(NULL);
           memset(&creds, 0, sizeof(creds));
           packet_start(SSH_SMSG_FAILURE);
           packet_send();
           packet_write_wait();
           return 0;
 }  }
   
 int auth_afs_token(struct passwd *pw, const char *token_string)  int
   auth_afs_token(struct passwd *pw, const char *token_string)
 {  {
   CREDENTIALS creds;          CREDENTIALS creds;
   uid_t uid = pw->pw_uid;          uid_t uid = pw->pw_uid;
   
   if (!radix_to_creds(token_string, &creds)) {          if (!radix_to_creds(token_string, &creds)) {
     log("Protocol error decoding AFS token");                  log("Protocol error decoding AFS token");
     packet_send_debug("Protocol error decoding AFS token");                  packet_send_debug("Protocol error decoding AFS token");
     packet_start(SSH_SMSG_FAILURE);                  packet_start(SSH_SMSG_FAILURE);
     packet_send();                  packet_send();
     packet_write_wait();                  packet_write_wait();
     return 0;                  return 0;
   }          }
   if (strncmp(creds.service, "", 1) == 0) /* backward compatibility */          if (strncmp(creds.service, "", 1) == 0) /* backward compatibility */
     strlcpy(creds.service, "afs", sizeof creds.service);                  strlcpy(creds.service, "afs", sizeof creds.service);
   
   if (strncmp(creds.pname, "AFS ID ", 7) == 0)          if (strncmp(creds.pname, "AFS ID ", 7) == 0)
     uid = atoi(creds.pname + 7);                  uid = atoi(creds.pname + 7);
   
   if (kafs_settoken(creds.realm, uid, &creds)) {          if (kafs_settoken(creds.realm, uid, &creds)) {
     log("AFS token (%s@%s) rejected for %s", creds.pname, creds.realm,                  log("AFS token (%s@%s) rejected for %s", creds.pname, creds.realm,
         pw->pw_name);                      pw->pw_name);
     packet_send_debug("AFS token (%s@%s) rejected for %s", creds.pname,                  packet_send_debug("AFS token (%s@%s) rejected for %s", creds.pname,
                       creds.realm, pw->pw_name);                                    creds.realm, pw->pw_name);
     memset(&creds, 0, sizeof(creds));                  memset(&creds, 0, sizeof(creds));
     packet_start(SSH_SMSG_FAILURE);                  packet_start(SSH_SMSG_FAILURE);
     packet_send();                  packet_send();
     packet_write_wait();                  packet_write_wait();
     return 0;                  return 0;
   }          }
   packet_send_debug("AFS token accepted (%s@%s, %s@%s)", creds.service,          packet_send_debug("AFS token accepted (%s@%s, %s@%s)", creds.service,
                     creds.realm, creds.pname, creds.realm);                            creds.realm, creds.pname, creds.realm);
   memset(&creds, 0, sizeof(creds));          memset(&creds, 0, sizeof(creds));
   packet_start(SSH_SMSG_SUCCESS);          packet_start(SSH_SMSG_SUCCESS);
   packet_send();          packet_send();
   packet_write_wait();          packet_write_wait();
   return 1;          return 1;
 }  }
 #endif /* AFS */  #endif /* AFS */
Legend:
Removed from v.1.8  
changed lines
  Added in v.1.9