[gssapi-openssh.git] / openssh / auth-krb5.c

/*
 *    Kerberos v5 authentication and ticket-passing routines.
 *
 * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
 */
/*
 * Copyright (c) 2002 Daniel Kouril.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$OpenBSD: auth-krb5.c,v 1.10 2002/11/21 23:03:51 deraadt Exp $");

#include "ssh.h"
#include "ssh1.h"
#include "packet.h"
#include "xmalloc.h"
#include "log.h"
#include "servconf.h"
#include "uidswap.h"
#include "auth.h"

#ifdef KRB5
#include <krb5.h>
#ifndef HEIMDAL
#define krb5_get_err_text(context,code) error_message(code)
#endif /* !HEIMDAL */

extern ServerOptions	 options;

static int
krb5_init(void *context)
{
	Authctxt *authctxt = (Authctxt *)context;
	krb5_error_code problem;
	static int cleanup_registered = 0;

	if (authctxt->krb5_ctx == NULL) {
		problem = krb5_init_context(&authctxt->krb5_ctx);
		if (problem)
			return (problem);
		krb5_init_ets(authctxt->krb5_ctx);
	}
	if (!cleanup_registered) {
		fatal_add_cleanup(krb5_cleanup_proc, authctxt);
		cleanup_registered = 1;
	}
	return (0);
}

/*
 * Try krb5 authentication. server_user is passed for logging purposes
 * only, in auth is received ticket, in client is returned principal
 * from the ticket
 */
int
auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *reply)
{
	krb5_error_code problem;
	krb5_principal server;
	krb5_ticket *ticket;
	int fd, ret;

	ret = 0;
	server = NULL;
	ticket = NULL;
	reply->length = 0;

	problem = krb5_init(authctxt);
	if (problem)
		goto err;

	problem = krb5_auth_con_init(authctxt->krb5_ctx,
	    &authctxt->krb5_auth_ctx);
	if (problem)
		goto err;

	fd = packet_get_connection_in();
#ifdef HEIMDAL
	problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
	    authctxt->krb5_auth_ctx, &fd);
#else
	problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx, 
	    authctxt->krb5_auth_ctx,fd,
	    KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR |
	    KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
#endif
	if (problem)
		goto err;

	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	    KRB5_NT_SRV_HST, &server);
	if (problem)
		goto err;

	problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
	    auth, server, NULL, NULL, &ticket);
	if (problem)
		goto err;

#ifdef HEIMDAL
	problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
	    &authctxt->krb5_user);
#else
	problem = krb5_copy_principal(authctxt->krb5_ctx, 
				      ticket->enc_part2->client,
				      &authctxt->krb5_user);
#endif
	if (problem)
		goto err;

	/* if client wants mutual auth */
	problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    reply);
	if (problem)
		goto err;

	/* Check .k5login authorization now. */
	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	    authctxt->pw->pw_name))
		goto err;

	if (client)
		krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
		    client);

	ret = 1;
 err:
	if (server)
		krb5_free_principal(authctxt->krb5_ctx, server);
	if (ticket)
		krb5_free_ticket(authctxt->krb5_ctx, ticket);
	if (!ret && reply->length) {
		xfree(reply->data);
		memset(reply, 0, sizeof(*reply));
	}

	if (problem) {
		if (authctxt->krb5_ctx != NULL)
			debug("Kerberos v5 authentication failed: %s",
			    krb5_get_err_text(authctxt->krb5_ctx, problem));
		else
			debug("Kerberos v5 authentication failed: %d",
			    problem);
	}

	return (ret);
}

int
auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt)
{
	krb5_error_code problem;
	krb5_ccache ccache = NULL;
	char *pname;
	krb5_creds **creds;

	if (authctxt->pw == NULL || authctxt->krb5_user == NULL)
		return (0);

	temporarily_use_uid(authctxt->pw);

#ifdef HEIMDAL
	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
#else
{
	char ccname[40];
	int tmpfd;
	
	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	
	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
		log("mkstemp(): %.100s", strerror(errno));
		problem = errno;
		goto fail;
	}
	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
		log("fchmod(): %.100s", strerror(errno));
		close(tmpfd);
		problem = errno;
		goto fail;
	}
	close(tmpfd);
	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
}
#endif
	if (problem)
		goto fail;

	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
	    authctxt->krb5_user);
	if (problem)
		goto fail;

#ifdef HEIMDAL
	problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    ccache, tgt);
	if (problem)
		goto fail;
#else
	problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    tgt, &creds, NULL);
	if (problem)
		goto fail;
	problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
	if (problem)
		goto fail;
#endif

	authctxt->krb5_fwd_ccache = ccache;
	ccache = NULL;

	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);

	problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	    &pname);
	if (problem)
		goto fail;

	debug("Kerberos v5 TGT accepted (%s)", pname);

	restore_uid();

	return (1);

 fail:
	if (problem)
		debug("Kerberos v5 TGT passing failed: %s",
		    krb5_get_err_text(authctxt->krb5_ctx, problem));
	if (ccache)
		krb5_cc_destroy(authctxt->krb5_ctx, ccache);

	restore_uid();

	return (0);
}

int
auth_krb5_password(Authctxt *authctxt, const char *password)
{
#ifndef HEIMDAL
	krb5_creds creds;
	krb5_principal server;
	char ccname[40];
	int tmpfd;
#endif	
	krb5_error_code problem;

	if (authctxt->pw == NULL)
		return (0);

	temporarily_use_uid(authctxt->pw);

	problem = krb5_init(authctxt);
	if (problem)
		goto out;

	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
		    &authctxt->krb5_user);
	if (problem)
		goto out;

#ifdef HEIMDAL
	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops,
	    &authctxt->krb5_fwd_ccache);
	if (problem)
		goto out;

	problem = krb5_cc_initialize(authctxt->krb5_ctx,
	    authctxt->krb5_fwd_ccache, authctxt->krb5_user);
	if (problem)
		goto out;

	restore_uid();
	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
	    authctxt->krb5_fwd_ccache, password, 1, NULL);
	temporarily_use_uid(authctxt->pw);

	if (problem)
		goto out;

#else
	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
	    authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
	if (problem)
		goto out;

	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	    KRB5_NT_SRV_HST, &server);
	if (problem)
		goto out;

	restore_uid();
	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
	    NULL, NULL, NULL);
	krb5_free_principal(authctxt->krb5_ctx, server);
	temporarily_use_uid(authctxt->pw);
	if (problem)
		goto out;
	
	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, 
			  authctxt->pw->pw_name)) {
		problem = -1;
		goto out;
	} 

	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	
	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
		log("mkstemp(): %.100s", strerror(errno));
		problem = errno;
		goto out;
	}
	
	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
		log("fchmod(): %.100s", strerror(errno));
		close(tmpfd);
		problem = errno;
		goto out;
	}
	close(tmpfd);

	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
	if (problem)
		goto out;

	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
				     authctxt->krb5_user);
	if (problem)
		goto out;
				
	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
				 &creds);
	if (problem)
		goto out;
#endif		

	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);

 out:
	restore_uid();

	if (problem) {
		if (authctxt->krb5_ctx != NULL && problem!=-1)
			debug("Kerberos password authentication failed: %s",
			    krb5_get_err_text(authctxt->krb5_ctx, problem));
		else
			debug("Kerberos password authentication failed: %d",
			    problem);

		krb5_cleanup_proc(authctxt);

		if (options.kerberos_or_local_passwd)
			return (-1);
		else
			return (0);
	}
	return (1);
}

void
krb5_cleanup_proc(void *context)
{
	Authctxt *authctxt = (Authctxt *)context;

	debug("krb5_cleanup_proc called");
	if (authctxt->krb5_fwd_ccache) {
		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
		authctxt->krb5_fwd_ccache = NULL;
	}
	if (authctxt->krb5_user) {
		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
		authctxt->krb5_user = NULL;
	}
	if (authctxt->krb5_auth_ctx) {
		krb5_auth_con_free(authctxt->krb5_ctx,
		    authctxt->krb5_auth_ctx);
		authctxt->krb5_auth_ctx = NULL;
	}
	if (authctxt->krb5_ctx) {
		krb5_free_context(authctxt->krb5_ctx);
		authctxt->krb5_ctx = NULL;
	}
}

#endif /* KRB5 */
Commit	Line	Data
3c0ef626	1	/*
3c0ef626	2	* Kerberos v5 authentication and ticket-passing routines.
350391c5	3	*
3c0ef626	4	* $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
3c0ef626	5	*/
350391c5	6	/*
	7	* Copyright (c) 2002 Daniel Kouril. All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	*
	18	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	19	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	20	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	21	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	22	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	23	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	24	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	25	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	26	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	27	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	28	*/
3c0ef626	29
3c0ef626	30	#include "includes.h"
bfe49944	31	RCSID("$OpenBSD: auth-krb5.c,v 1.10 2002/11/21 23:03:51 deraadt Exp $");
e9702f7d	32
3c0ef626	33	#include "ssh.h"
	34	#include "ssh1.h"
	35	#include "packet.h"
	36	#include "xmalloc.h"
	37	#include "log.h"
	38	#include "servconf.h"
	39	#include "uidswap.h"
	40	#include "auth.h"
	41
	42	#ifdef KRB5
	43	#include <krb5.h>
63119dd9	44	#ifndef HEIMDAL
	45	#define krb5_get_err_text(context,code) error_message(code)
	46	#endif /* !HEIMDAL */
3c0ef626	47
	48	extern ServerOptions options;
	49
	50	static int
	51	krb5_init(void *context)
	52	{
	53	Authctxt authctxt = (Authctxt )context;
	54	krb5_error_code problem;
	55	static int cleanup_registered = 0;
e9702f7d	56
3c0ef626	57	if (authctxt->krb5_ctx == NULL) {
	58	problem = krb5_init_context(&authctxt->krb5_ctx);
	59	if (problem)
	60	return (problem);
	61	krb5_init_ets(authctxt->krb5_ctx);
	62	}
	63	if (!cleanup_registered) {
	64	fatal_add_cleanup(krb5_cleanup_proc, authctxt);
	65	cleanup_registered = 1;
	66	}
	67	return (0);
	68	}
	69
	70	/*
	71	* Try krb5 authentication. server_user is passed for logging purposes
	72	* only, in auth is received ticket, in client is returned principal
	73	* from the ticket
	74	*/
e9702f7d	75	int
d03f4262	76	auth_krb5(Authctxt authctxt, krb5_data auth, char *client, krb5_data reply)
3c0ef626	77	{
	78	krb5_error_code problem;
	79	krb5_principal server;
3c0ef626	80	krb5_ticket *ticket;
	81	int fd, ret;
	82
	83	ret = 0;
	84	server = NULL;
	85	ticket = NULL;
d03f4262	86	reply->length = 0;
e9702f7d	87
3c0ef626	88	problem = krb5_init(authctxt);
e9702f7d	89	if (problem)
3c0ef626	90	goto err;
e9702f7d	91
3c0ef626	92	problem = krb5_auth_con_init(authctxt->krb5_ctx,
	93	&authctxt->krb5_auth_ctx);
	94	if (problem)
	95	goto err;
e9702f7d	96
3c0ef626	97	fd = packet_get_connection_in();
63119dd9	98	#ifdef HEIMDAL
3c0ef626	99	problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
3c0ef626	100	authctxt->krb5_auth_ctx, &fd);
63119dd9	101	#else
	102	problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx,
	103	authctxt->krb5_auth_ctx,fd,
	104	KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR \|
	105	KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
	106	#endif
3c0ef626	107	if (problem)
3c0ef626	108	goto err;
e9702f7d	109
bfe49944	110	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
3c0ef626	111	KRB5_NT_SRV_HST, &server);
	112	if (problem)
	113	goto err;
e9702f7d	114
3c0ef626	115	problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
	116	auth, server, NULL, NULL, &ticket);
	117	if (problem)
	118	goto err;
905081a4	119
905081a4	120	#ifdef HEIMDAL
3c0ef626	121	problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
3c0ef626	122	&authctxt->krb5_user);
63119dd9	123	#else
905081a4	124	problem = krb5_copy_principal(authctxt->krb5_ctx,
	125	ticket->enc_part2->client,
	126	&authctxt->krb5_user);
63119dd9	127	#endif
3c0ef626	128	if (problem)
3c0ef626	129	goto err;
e9702f7d	130
3c0ef626	131	/* if client wants mutual auth */
3c0ef626	132	problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
d03f4262	133	reply);
3c0ef626	134	if (problem)
3c0ef626	135	goto err;
e9702f7d	136
3c0ef626	137	/* Check .k5login authorization now. */
	138	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	139	authctxt->pw->pw_name))
	140	goto err;
e9702f7d	141
3c0ef626	142	if (client)
	143	krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	144	client);
e9702f7d	145
3c0ef626	146	ret = 1;
	147	err:
	148	if (server)
	149	krb5_free_principal(authctxt->krb5_ctx, server);
	150	if (ticket)
	151	krb5_free_ticket(authctxt->krb5_ctx, ticket);
d03f4262	152	if (!ret && reply->length) {
	153	xfree(reply->data);
	154	memset(reply, 0, sizeof(*reply));
	155	}
e9702f7d	156
	157	if (problem) {
	158	if (authctxt->krb5_ctx != NULL)
	159	debug("Kerberos v5 authentication failed: %s",
	160	krb5_get_err_text(authctxt->krb5_ctx, problem));
	161	else
	162	debug("Kerberos v5 authentication failed: %d",
	163	problem);
	164	}
3c0ef626	165
	166	return (ret);
	167	}
	168
	169	int
	170	auth_krb5_tgt(Authctxt authctxt, krb5_data tgt)
	171	{
	172	krb5_error_code problem;
	173	krb5_ccache ccache = NULL;
	174	char *pname;
63119dd9	175	krb5_creds **creds;
905081a4	176
3c0ef626	177	if (authctxt->pw == NULL \|\| authctxt->krb5_user == NULL)
3c0ef626	178	return (0);
e9702f7d	179
3c0ef626	180	temporarily_use_uid(authctxt->pw);
905081a4	181
905081a4	182	#ifdef HEIMDAL
3c0ef626	183	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
63119dd9	184	#else
63119dd9	185	{
905081a4	186	char ccname[40];
905081a4	187	int tmpfd;
63119dd9	188
905081a4	189	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
905081a4	190
e444f4cb	191	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
905081a4	192	log("mkstemp(): %.100s", strerror(errno));
	193	problem = errno;
	194	goto fail;
	195	}
	196	if (fchmod(tmpfd,S_IRUSR \| S_IWUSR) == -1) {
	197	log("fchmod(): %.100s", strerror(errno));
	198	close(tmpfd);
	199	problem = errno;
	200	goto fail;
	201	}
	202	close(tmpfd);
63119dd9	203	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
	204	}
	205	#endif
3c0ef626	206	if (problem)
3c0ef626	207	goto fail;
e9702f7d	208
3c0ef626	209	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
	210	authctxt->krb5_user);
	211	if (problem)
	212	goto fail;
905081a4	213
905081a4	214	#ifdef HEIMDAL
3c0ef626	215	problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	216	ccache, tgt);
	217	if (problem)
	218	goto fail;
63119dd9	219	#else
	220	problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	221	tgt, &creds, NULL);
905081a4	222	if (problem)
63119dd9	223	goto fail;
	224	problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
	225	if (problem)
905081a4	226	goto fail;
63119dd9	227	#endif
905081a4	228
3c0ef626	229	authctxt->krb5_fwd_ccache = ccache;
3c0ef626	230	ccache = NULL;
e9702f7d	231
3c0ef626	232	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
e9702f7d	233
3c0ef626	234	problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	235	&pname);
	236	if (problem)
	237	goto fail;
e9702f7d	238
3c0ef626	239	debug("Kerberos v5 TGT accepted (%s)", pname);
e9702f7d	240
3c0ef626	241	restore_uid();
e9702f7d	242
3c0ef626	243	return (1);
e9702f7d	244
3c0ef626	245	fail:
	246	if (problem)
	247	debug("Kerberos v5 TGT passing failed: %s",
	248	krb5_get_err_text(authctxt->krb5_ctx, problem));
	249	if (ccache)
	250	krb5_cc_destroy(authctxt->krb5_ctx, ccache);
e9702f7d	251
3c0ef626	252	restore_uid();
e9702f7d	253
3c0ef626	254	return (0);
	255	}
	256
	257	int
	258	auth_krb5_password(Authctxt authctxt, const char password)
	259	{
63119dd9	260	#ifndef HEIMDAL
e444f4cb	261	krb5_creds creds;
63119dd9	262	krb5_principal server;
e444f4cb	263	char ccname[40];
e444f4cb	264	int tmpfd;
63119dd9	265	#endif
3c0ef626	266	krb5_error_code problem;
e9702f7d	267
3c0ef626	268	if (authctxt->pw == NULL)
3c0ef626	269	return (0);
e9702f7d	270
3c0ef626	271	temporarily_use_uid(authctxt->pw);
e9702f7d	272
3c0ef626	273	problem = krb5_init(authctxt);
	274	if (problem)
	275	goto out;
e9702f7d	276
3c0ef626	277	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
	278	&authctxt->krb5_user);
	279	if (problem)
	280	goto out;
905081a4	281
905081a4	282	#ifdef HEIMDAL
3c0ef626	283	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops,
	284	&authctxt->krb5_fwd_ccache);
	285	if (problem)
	286	goto out;
e9702f7d	287
3c0ef626	288	problem = krb5_cc_initialize(authctxt->krb5_ctx,
	289	authctxt->krb5_fwd_ccache, authctxt->krb5_user);
	290	if (problem)
	291	goto out;
905081a4	292
e9702f7d	293	restore_uid();
3c0ef626	294	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
3c0ef626	295	authctxt->krb5_fwd_ccache, password, 1, NULL);
e444f4cb	296	temporarily_use_uid(authctxt->pw);
	297
	298	if (problem)
3c0ef626	299	goto out;
e444f4cb	300
63119dd9	301	#else
905081a4	302	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
e444f4cb	303	authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
e444f4cb	304	if (problem)
905081a4	305	goto out;
e444f4cb	306
905081a4	307	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
905081a4	308	KRB5_NT_SRV_HST, &server);
e444f4cb	309	if (problem)
905081a4	310	goto out;
e444f4cb	311
e444f4cb	312	restore_uid();
905081a4	313	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
905081a4	314	NULL, NULL, NULL);
905081a4	315	krb5_free_principal(authctxt->krb5_ctx, server);
63119dd9	316	temporarily_use_uid(authctxt->pw);
e444f4cb	317	if (problem)
	318	goto out;
	319
	320	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	321	authctxt->pw->pw_name)) {
44a053a3	322	problem = -1;
e444f4cb	323	goto out;
	324	}
	325
	326	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	327
	328	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
	329	log("mkstemp(): %.100s", strerror(errno));
	330	problem = errno;
905081a4	331	goto out;
905081a4	332	}
63119dd9	333
e444f4cb	334	if (fchmod(tmpfd,S_IRUSR \| S_IWUSR) == -1) {
	335	log("fchmod(): %.100s", strerror(errno));
	336	close(tmpfd);
	337	problem = errno;
905081a4	338	goto out;
905081a4	339	}
e444f4cb	340	close(tmpfd);
	341
	342	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
	343	if (problem)
	344	goto out;
63119dd9	345
e444f4cb	346	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
e444f4cb	347	authctxt->krb5_user);
905081a4	348	if (problem)
905081a4	349	goto out;
e444f4cb	350
	351	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
	352	&creds);
	353	if (problem)
	354	goto out;
	355	#endif
63119dd9	356
3c0ef626	357	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
e9702f7d	358
3c0ef626	359	out:
3c0ef626	360	restore_uid();
e9702f7d	361
3c0ef626	362	if (problem) {
e444f4cb	363	if (authctxt->krb5_ctx != NULL && problem!=-1)
e9702f7d	364	debug("Kerberos password authentication failed: %s",
	365	krb5_get_err_text(authctxt->krb5_ctx, problem));
	366	else
	367	debug("Kerberos password authentication failed: %d",
	368	problem);
	369
3c0ef626	370	krb5_cleanup_proc(authctxt);
e9702f7d	371
3c0ef626	372	if (options.kerberos_or_local_passwd)
	373	return (-1);
	374	else
	375	return (0);
	376	}
	377	return (1);
	378	}
	379
	380	void
	381	krb5_cleanup_proc(void *context)
	382	{
	383	Authctxt authctxt = (Authctxt )context;
e9702f7d	384
3c0ef626	385	debug("krb5_cleanup_proc called");
	386	if (authctxt->krb5_fwd_ccache) {
	387	krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
	388	authctxt->krb5_fwd_ccache = NULL;
	389	}
	390	if (authctxt->krb5_user) {
	391	krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
	392	authctxt->krb5_user = NULL;
	393	}
	394	if (authctxt->krb5_auth_ctx) {
	395	krb5_auth_con_free(authctxt->krb5_ctx,
	396	authctxt->krb5_auth_ctx);
	397	authctxt->krb5_auth_ctx = NULL;
	398	}
	399	if (authctxt->krb5_ctx) {
	400	krb5_free_context(authctxt->krb5_ctx);
	401	authctxt->krb5_ctx = NULL;
	402	}
	403	}
	404
	405	#endif /* KRB5 */