3 * Copyright (C) 1988-1998 by the Massachusetts Institute of Technology.
4 * For copying and distribution information, please see the file
8 #include <mit-copyright.h>
10 #include "update_server.h"
12 #include <sys/utsname.h>
24 static char service[] = "rcmd";
25 static char master[] = "sms";
26 static char qmark[] = "???";
28 extern des_cblock session;
32 * authentication request auth_002:
34 * >>> (STRING) "auth_002"
39 * >>> (STRING) encrypted nonce
44 void auth_002(int conn, char *str)
47 char aname[ANAME_SZ], ainst[INST_SZ], arealm[REALM_SZ];
49 char *p, *first, *data;
52 des_key_schedule sched;
53 des_cblock nonce, nonce2;
58 recv_string(conn, &data, &size);
59 if (size > sizeof(ticket_st.dat))
61 code = KE_RD_AP_UNDEC;
62 com_err(whoami, code, ": authenticator too large");
66 memcpy(ticket_st.dat, data, size);
69 ticket_st.length = size;
70 code = krb_rd_req(&ticket_st, service, krb_get_phost(hostname), 0,
74 code += ERROR_TABLE_BASE_krb;
75 strcpy(ad.pname, qmark);
76 strcpy(ad.pinst, qmark);
77 strcpy(ad.prealm, qmark);
81 /* If there is an auth record in the config file matching the
82 * authenticator we received, then accept it. If there's no
83 * auth record, assume [master]@[local realm].
85 if ((first = p = config_lookup("auth")))
89 kname_parse(aname, ainst, arealm, p);
90 if (strcmp(aname, ad.pname) ||
91 strcmp(ainst, ad.pinst) ||
92 strcmp(arealm, ad.prealm))
93 p = config_lookup("auth");
101 strcpy(aname, master);
103 if (krb_get_lrealm(arealm, 1))
104 strcpy(arealm, KRB_REALM);
107 if (strcmp(aname, ad.pname) ||
108 strcmp(ainst, ad.pinst) ||
109 strcmp(arealm, ad.prealm))
114 /* replay protection */
115 des_random_key(&nonce);
116 send_string(conn, (char *)nonce, sizeof(nonce));
117 recv_string(conn, &data, &size);
118 des_key_sched(ad.session, sched);
119 des_ecb_encrypt(data, nonce2, sched, 0);
121 if (memcmp(nonce, nonce2, sizeof(nonce)))
125 have_authorization = 1;
126 /* Stash away session key */
127 memcpy(session, ad.session, sizeof(session));
131 com_err(whoami, code, "auth for %s.%s@%s failed",
132 ad.pname, ad.pinst, ad.prealm);
133 send_int(conn, code);
135 send_int(conn, MR_NO_KRB4);