Some globals that really should be wrapped in

[moira.git] / server / mr_sauth.c

diff --git a/server/mr_sauth.c b/server/mr_sauth.c
index 817888c775759a3621a40f40c93931a88100c594..52431de14caffeaea99655e48f9c6c61cef48c6f 100644 (file)
--- a/server/mr_sauth.c
+++ b/server/mr_sauth.c
@@ -22,6 +22,10 @@
 RCSID("$Header$");
 
 extern char *whoami, *host;
+extern int proxy_acl;
+
+static int set_client(client *cl, char *kname,
+                     char *name, char *inst, char *realm);
 
 typedef struct _replay_cache {
   KTEXT_ST auth;
@@ -39,16 +43,16 @@ replay_cache *rcache = NULL;
  * cl->cl_name.
  */
 
-void do_auth(client *cl, mr_params req)
+void do_auth(client *cl)
 {
   KTEXT_ST auth;
   AUTH_DAT ad;
-  int status, ok;
+  int status;
   replay_cache *rc, *rcnew;
   time_t now;
 
-  auth.length = req.mr_argl[0];
-  memcpy(auth.dat, req.mr_argv[0], auth.length);
+  auth.length = cl->req.mr_argl[0];
+  memcpy(auth.dat, cl->req.mr_argv[0], auth.length);
   auth.mbz = 0;
 
   if ((status = krb_rd_req(&auth, MOIRA_SNAME, host,
@@ -62,7 +66,7 @@ void do_auth(client *cl, mr_params req)
 
   if (!rcache)
     {
-      rcache = malloc(sizeof(replay_cache));
+      rcache = xmalloc(sizeof(replay_cache));
       memset(rcache, 0, sizeof(replay_cache));
     }
 
@@ -84,7 +88,7 @@ void do_auth(client *cl, mr_params req)
 
   /* add new entry */
   time(&now);
-  rcnew = malloc(sizeof(replay_cache));
+  rcnew = xmalloc(sizeof(replay_cache));
   memcpy(&(rcnew->auth), &auth, sizeof(KTEXT_ST));
   rcnew->expires = now + 2 * CLOCK_SKEW;
   rcnew->next = rcache->next;
@@ -103,21 +107,11 @@ void do_auth(client *cl, mr_params req)
        rc = rc->next;
     }
 
-  memcpy(cl->kname.name, ad.pname, ANAME_SZ);
-  memcpy(cl->kname.inst, ad.pinst, INST_SZ);
-  memcpy(cl->kname.realm, ad.prealm, REALM_SZ);
-  strcpy(cl->clname, kname_unparse(ad.pname, ad.pinst, ad.prealm));
+  status = set_client(cl, kname_unparse(ad.pname, ad.pinst, ad.prealm),
+                     ad.pname, ad.pinst, ad.prealm);
 
-  if (ad.pinst[0] == 0 && !strcmp(ad.prealm, krb_realm))
-    ok = 1;
-  else
-    ok = 0;
-  /* this is in a separate function because it accesses the database */
-  status = set_krb_mapping(cl->clname, ad.pname, ok,
-                          &cl->client_id, &cl->users_id);
-
-  strncpy(cl->entity, req.mr_argv[1], 8);
-  cl->entity[8] = 0;
+  strncpy(cl->entity, cl->req.mr_argv[1], sizeof(cl->entity) - 1);
+  cl->entity[sizeof(cl->entity) - 1] = 0;
 
   memset(&ad, 0, sizeof(ad));  /* Clean up session key, etc. */
 
@@ -129,3 +123,62 @@ void do_auth(client *cl, mr_params req)
   else
     client_reply(cl, MR_USER_AUTH);
 }
+
+void do_proxy(client *cl)
+{
+  char name[ANAME_SZ], inst[INST_SZ], realm[REALM_SZ];
+  char kname[MAX_K_NAME_SZ];
+
+  if (cl->proxy_id)
+    {
+      com_err(whoami, MR_PERM, "Cannot re-proxy");
+      client_reply(cl, MR_PERM);
+      return;
+    }
+
+  if (kname_parse(name, inst, realm, cl->req.mr_argv[0]) != KSUCCESS)
+    {
+      com_err(whoami, KE_KNAME_FMT, "while parsing proxy name %s",
+             cl->req.mr_argv);
+      client_reply(cl, KE_KNAME_FMT);
+      return;
+    }
+
+  if (!*realm)
+    {
+      strcpy(realm, krb_realm);
+      sprintf(kname, "%s@%s", cl->req.mr_argv[0], realm);
+    }
+  else
+    strcpy(kname, cl->req.mr_argv[0]);
+    
+  if (find_member("LIST", proxy_acl, cl))
+    {
+      cl->proxy_id = cl->client_id;
+      set_client(cl, kname, name, inst, realm);
+      com_err(whoami, 0, "Proxy authentication as %s (uid %d cid %d) via %s",
+             kname, cl->users_id, cl->client_id, cl->req.mr_argv[1]);
+      client_reply(cl, MR_SUCCESS);
+    }
+  else
+    {
+      com_err(whoami, MR_PERM, "Proxy authentication denied");
+      client_reply(cl, MR_PERM);
+    }
+}
+
+static int set_client(client *cl, char *kname,
+                     char *name, char *inst, char *realm)
+{
+  int ok;
+
+  strncpy(cl->clname, kname, sizeof(cl->clname));
+  cl->clname[sizeof(cl->clname) - 1] = '\0';
+
+  if (inst[0] == 0 && !strcmp(realm, krb_realm))
+    ok = 1;
+  else
+    ok = 0;
+  /* this is in a separate function because it accesses the database */
+  return set_krb_mapping(cl->clname, name, ok, &cl->client_id, &cl->users_id);
+}