Merge changes from moira-krb5 CVS branch.

diff --git a/clients/lib/utils.c b/clients/lib/utils.c
index 7a89c93b5e7fedc2d4d7033bafb15f55fc3f6c2e..540fee7a3fc67a13da77485a4c38ae8a0660a67e 100644 (file)
--- a/clients/lib/utils.c
+++ b/clients/lib/utils.c
@@ -13,6 +13,7 @@
 
 #include <com_err.h>
 #include <krb.h>
+#include <krb5.h>
 
 #include <sys/types.h>
 
@@ -34,6 +35,7 @@
 RCSID("$Header$");
 
 extern char *whoami;
+extern krb5_context context;
 
 int mrcl_connect(char *server, char *client, int version, int auth)
 {
@@ -88,7 +90,7 @@ int mrcl_connect(char *server, char *client, int version, int auth)
 
   if (auth)
     {
-      status = mr_auth(client);
+      status = mr_krb5_auth(client);
       if (status)
        {
          com_err(whoami, status, "while authenticating to Moira.");
@@ -102,26 +104,31 @@ int mrcl_connect(char *server, char *client, int version, int auth)
 
 char *mrcl_krb_user(void)
 {
-  int status;
-  static char pname[ANAME_SZ];
+  int flags = 0;
+  krb5_ccache cache = NULL;
+  krb5_principal princ;
+  krb5_error_code status;
+  char *name;
+
+  if (!context)
+    krb5_init_context(&context);
 
-  status = tf_init(TKT_FILE, R_TKT_FIL);
-  if (status == KSUCCESS)
+  status = krb5_cc_default(context, &cache);
+  if (status)
     {
-      status = tf_get_pname(pname);
-      tf_close();
+      com_err(whoami, status, "while reading Kerberos ticket file.");
+      return NULL;
     }
 
-  if (status != KSUCCESS)
+  status = krb5_cc_get_principal(context, cache, &princ);
+  if (status)
     {
-      /* In case mr_init hasn't been called yet. */
-      initialize_krb_error_table();
-      status += ERROR_TABLE_BASE_krb;
-      com_err(whoami, status, "reading Kerberos ticket file.");
+      com_err(whoami, status, "while retrieving principal name.");
       return NULL;
     }
 
-  return pname;
+  return (char *)krb5_princ_component(context, princ, 0);
+
 }
 
 char *partial_canonicalize_hostname(char *s)

diff --git a/clients/moira/main.c b/clients/moira/main.c
index 5bceacbe2f56036b13c6a5d6e0adc74fdcfbf69f..3a231d27830d8abfa445fa46e853497c8a6134e2 100644 (file)
--- a/clients/moira/main.c
+++ b/clients/moira/main.c
@@ -107,7 +107,7 @@ int main(int argc, char **argv)
       != MRCL_SUCCESS)
     exit(1);
 
-  if ((status = mr_auth(program_name)))
+  if ((status = mr_krb5_auth(program_name)))
     {
       if (status == MR_USER_AUTH)
        {

diff --git a/clients/moira/namespace.c b/clients/moira/namespace.c
index 9bc6bfe9003e537b3efa29fd9c9b235154aa2706..c544d2f75c5da9f76e3a00115a7f99e133b252e4 100644 (file)
--- a/clients/moira/namespace.c
+++ b/clients/moira/namespace.c
@@ -232,7 +232,7 @@ int main(int argc, char **argv)
       != MRCL_SUCCESS)
     exit(1);
 
-  if ((status = mr_auth(program_name)))
+  if ((status = mr_krb5_auth(program_name)))
     {
       if (status == MR_USER_AUTH)
        {

diff --git a/clients/moira/utils.c b/clients/moira/utils.c
index 5de89e5d6b139a103ff88bb2c05df58a7ff33d66..5af6de4377233e18a624bfa52f68bdd0edae9956 100644 (file)
--- a/clients/moira/utils.c
+++ b/clients/moira/utils.c
@@ -890,7 +890,7 @@ int do_mr_query(char *name, int argc, char **argv,
              moira_server);
       return MR_ABORTED;
     }
-  status = mr_auth(whoami);
+  status = mr_krb5_auth(whoami);
   if (status)
     {
       com_err(whoami, status, " while re-authenticating to server %s",

diff --git a/clients/mrcheck/mrcheck.c b/clients/mrcheck/mrcheck.c
index 0a0202a44428c1cb494477da358f44f389a8b19b..e1b77301ffe4cdb2ea602bb5a4e17091cf73e55a 100644 (file)
--- a/clients/mrcheck/mrcheck.c
+++ b/clients/mrcheck/mrcheck.c
@@ -199,7 +199,7 @@ int main(int argc, char *argv[])
 
   if (mrcl_connect(server, NULL, 2, 0) != MRCL_SUCCESS)
     exit(2);
-  status = mr_auth("mrcheck");
+  status = mr_krb5_auth("mrcheck");
   if (status && auth_required)
     {
       sprintf(buf, "\nAuthorization failure -- run \"kinit\" and try again");

diff --git a/clients/mrtest/mrtest.c b/clients/mrtest/mrtest.c
index 0f928875e4698089c40a24f6cef45ab0e106a83e..ca451942e6357240e83e9af6c16fbdda721c778f 100644 (file)
--- a/clients/mrtest/mrtest.c
+++ b/clients/mrtest/mrtest.c
@@ -71,6 +71,7 @@ void test_dcm(void);
 void test_script(int argc, char **argv);
 void test_list_requests(void);
 void test_version(int argc, char **argv);
+void test_krb5_auth(void);
 void set_signal_handler(int, void (*handler)(int));
 void set_signal_blocking(int, int);
 
@@ -179,7 +180,7 @@ void execute_line(char *cmdbuf)
   else if (!strcmp(argv[0], "query") || !strcmp(argv[0], "qy"))
     test_query(argc, argv);
   else if (!strcmp(argv[0], "auth") || !strcmp(argv[0], "a"))
-    test_auth();
+    test_krb5_auth();
   else if (!strcmp(argv[0], "proxy") || !strcmp(argv[0], "p"))
     test_proxy(argc, argv);
   else if (!strcmp(argv[0], "access"))
@@ -195,6 +196,8 @@ void execute_line(char *cmdbuf)
     quit = 1;
   else if (!strcmp(argv[0], "version") || !strcmp(argv[0], "v"))
     test_version(argc, argv);
+  else if (!strcmp(argv[0], "krb4_auth") || !strcmp(argv[0], "4"))
+    test_auth();
   else
     {
       fprintf(stderr, "moira: Unknown request \"%s\".  "
@@ -314,6 +317,15 @@ void test_auth(void)
     com_err("moira (auth)", status, "");
 }
 
+void test_krb5_auth(void)
+{
+  int status;
+
+  status = mr_krb5_auth("mrtest");
+  if (status)
+    com_err("moira (krb5_auth)", status, "");
+}
+
 void test_proxy(int argc, char *argv[])
 {
   int status;

diff --git a/dcm/dcm.pc b/dcm/dcm.pc
index 8c7199aa2f1b7f73d0bb8775a43559c7281f767a..7117412b600aae26ad528042577c1b1779f30f8b 100644 (file)
--- a/dcm/dcm.pc
+++ b/dcm/dcm.pc
@@ -490,7 +490,9 @@ int dcm_send_file(char *service, int type, char *host, char *target)
       return MR_CANT_CONNECT;
     }
 
-  code = mr_send_auth(conn, host);
+  code = mr_send_krb5_auth(conn, host);
+  if (code)
+    code = mr_send_auth(conn, host);
   if (code)
     {
       com_err(whoami, code, "authenticating to %s", host);

diff --git a/include/moira.h b/include/moira.h
index 9e916011384c667ed45327ef46df70f966d357cd..3d49552a76e46d53bdf5d40c0133ee9bc7ab50e5 100644 (file)
--- a/include/moira.h
+++ b/include/moira.h
@@ -47,7 +47,8 @@
 #define MR_MOTD 6
 #define MR_PROXY 7
 #define MR_SETVERSION 8
-#define MR_MAX_PROC 8
+#define MR_KRB5_AUTH 9
+#define MR_MAX_PROC 9
 
 /* values used in NFS physical flags */
 #define MR_FS_STUDENT  0x0001

diff --git a/incremental/afs/afs.c b/incremental/afs/afs.c
index 2ec09e1858d7f3a059e9add5f5cd9d0f8b0fd2d0..dd2dee2ca5a677979b93521c520f4db032f881c9 100644 (file)
--- a/incremental/afs/afs.c
+++ b/incremental/afs/afs.c
@@ -723,7 +723,7 @@ int moira_connect(void)
       uname(&uts);
       code = mr_connect(uts.nodename);
       if (!code)
-       code = mr_auth("afs.incr");
+       code = mr_krb5_auth("afs.incr");
       return code;
     }
   return 0;

diff --git a/incremental/winad/winad.c b/incremental/winad/winad.c
index 7a02541e766763ff4f0eb5254cf95144824930a9..dcb1e9e7f561102b3f2fa78943462627cb818bfc 100755 (executable)
--- a/incremental/winad/winad.c
+++ b/incremental/winad/winad.c
@@ -1726,7 +1726,7 @@ int moira_connect(void)
 #endif /*WIN32*/
 /*det
       if (!rc)
-        rc = mr_auth("winad.incr");
+        rc = mr_krb5_auth("winad.incr");
 */
       return rc;
     }
@@ -3344,7 +3344,7 @@ int mr_connect_cl(char *server, char *client, int version, int auth)
 
   if (auth)
     {
-      status = mr_auth(client);
+      status = mr_krb5_auth(client);
       if (status)
         {
           com_err(whoami, status, "while authenticating to Moira.");

diff --git a/lib/mr_auth.c b/lib/mr_auth.c
index 06d38d36fae76858a7eb5d45d8aaa1d2ac673741..9c7641bb4405f4fa100efd84374820e5ee26223c 100644 (file)
--- a/lib/mr_auth.c
+++ b/lib/mr_auth.c
@@ -16,6 +16,10 @@
 #include <string.h>
 
 #include <krb.h>
+#include <krb5.h>
+
+krb5_context context = NULL;
+krb5_auth_context auth_con = NULL;
 
 RCSID("$Header$");
 
@@ -88,3 +92,73 @@ int mr_proxy(char *principal, char *orig_authtype)
 
   return status;
 }
+
+int mr_krb5_auth(char *prog)
+{
+  mr_params params, reply;
+  char host[BUFSIZ], *p;
+  char *args[2];
+  int argl[2];
+  krb5_ccache ccache = NULL;
+  krb5_data auth;
+  krb5_error_code problem = 0;
+
+  CHECK_CONNECTED;
+
+  memset(&auth, 0, sizeof(auth));
+
+  if ((problem = mr_host(host, sizeof(host) - 1)))
+    return problem;
+
+  for (p = host; *p && *p != '.'; p++)
+    {
+      if (isupper(*p))
+       *p = tolower(*p);
+    }
+  *p = '\0';
+
+  if (!context)
+    {
+      problem = krb5_init_context(&context);
+      if (problem)
+       goto out;
+    }
+
+  problem = krb5_auth_con_init(context, &auth_con);
+  if (problem)
+    goto out;
+
+  problem = krb5_cc_default(context, &ccache);
+  if (problem)
+    goto out;
+
+  problem = krb5_mk_req(context, &auth_con, NULL, MOIRA_SNAME, host, NULL, 
+                      ccache, &auth);
+  if (problem)
+    goto out;
+
+  params.u.mr_procno = MR_KRB5_AUTH;
+  params.mr_argc = 2;
+  params.mr_argv = args;
+  params.mr_argl = argl;
+  params.mr_argv[0] = (char *)auth.data;
+  params.mr_argl[0] = auth.length;
+  params.mr_argv[1] = prog;
+  params.mr_argl[1] = strlen(prog) + 1;
+
+  if ((problem = mr_do_call(&params, &reply)) == MR_SUCCESS)
+    problem = reply.u.mr_status;
+
+  mr_destroy_reply(reply);
+
+ out:
+  if (ccache)
+    krb5_cc_close(context, ccache);
+  krb5_free_data_contents(context, &auth);
+  if (auth_con)
+    krb5_auth_con_free(context, auth_con);
+  auth_con = NULL;
+
+  return problem;
+}
+      

diff --git a/reg_svr/reg_svr.pc b/reg_svr/reg_svr.pc
index 7beb6f0af8b0bc9ab914f550960f90aecef9eb4f..504712f719752e0da3c2465d2e13c36e792d5050 100644 (file)
--- a/reg_svr/reg_svr.pc
+++ b/reg_svr/reg_svr.pc
@@ -808,7 +808,7 @@ int register_user(int uid, char *username)
   if (status)
     status += ERROR_TABLE_BASE_krb;
   else
-    status = mr_auth("reg_svr");
+    status = mr_krb5_auth("reg_svr");
   if (status)
     {
       com_err(whoami, status, "authenticating to moira");

diff --git a/server/mr_main.c b/server/mr_main.c
index 1b90b849c797cd982117ec4ef26969295fb5085c..7337f4551f385cd0d728686be164cc9106d1ca4b 100644 (file)
--- a/server/mr_main.c
+++ b/server/mr_main.c
@@ -29,6 +29,7 @@
 #include <unistd.h>
 
 #include <krb.h>
+#include <krb5.h>
 
 RCSID("$Header$");
 
@@ -42,6 +43,7 @@ time_t now;
 
 char *host;
 char krb_realm[REALM_SZ];
+krb5_context context = NULL;
 
 /* Client array and associated data. This needs to be global for _list_users */
 client **clients;
@@ -106,6 +108,13 @@ int main(int argc, char **argv)
 
   krb_get_lrealm(krb_realm, 1);
 
+  status = krb5_init_context(&context);
+  if (status)
+    {
+      com_err(whoami, status, "Initializing krb5 context.");
+      exit(1);
+    }
+
   /*
    * Database initialization.  Only init if database should be open.
    */

diff --git a/server/mr_sauth.c b/server/mr_sauth.c
index 9f6a4d031be4b328bb3f6e055579a67807b6bb6e..8e83101b8f1b1b46f5a9326eb9deffea0d41c1d3 100644 (file)
--- a/server/mr_sauth.c
+++ b/server/mr_sauth.c
@@ -23,6 +23,7 @@ RCSID("$Header$");
 
 extern char *whoami, *host;
 extern int proxy_acl;
+extern krb5_context context;
 
 static int set_client(client *cl, char *kname,
                      char *name, char *inst, char *realm);
@@ -175,10 +176,94 @@ static int set_client(client *cl, char *kname,
   strncpy(cl->clname, kname, sizeof(cl->clname));
   cl->clname[sizeof(cl->clname) - 1] = '\0';
 
-  if (inst[0] == 0 && !strcmp(realm, krb_realm))
+  if ((!inst || inst[0] == 0) && !strcmp(realm, krb_realm))
     ok = 1;
   else
     ok = 0;
   /* this is in a separate function because it accesses the database */
   return set_krb_mapping(cl->clname, name, ok, &cl->client_id, &cl->users_id);
 }
+
+void do_krb5_auth(client *cl)
+{
+  krb5_data auth;
+  krb5_auth_context auth_con = NULL;
+  krb5_principal server = NULL, client = NULL;
+  krb5_ticket *ticket;
+  char name[ANAME_SZ], inst[INST_SZ], realm[REALM_SZ];
+  int status;
+
+  ticket = NULL;
+
+  status = krb5_auth_con_init(context, &auth_con);
+  if (status)
+    {
+      client_reply(cl, status);
+      com_err(whoami, status, "(krb5 auth context init failed)");
+      goto out;
+    }
+
+  status = krb5_sname_to_principal(context, host, MOIRA_SNAME, 
+                                   KRB5_NT_SRV_HST, &server);
+  if (status)
+    {
+      client_reply(cl, status);
+      com_err(whoami, status, "(krb5_sname_to_principal failed)");
+      goto out;
+    }
+
+  auth.length = cl->req.mr_argl[0];
+  auth.data = cl->req.mr_argv[0];
+
+  status = krb5_rd_req(context, &auth_con, &auth, server, NULL, NULL,
+                       &ticket);
+  if (status)
+    {
+      client_reply(cl, status);
+      com_err(whoami, status, " (krb5 authentication failed)");
+      goto out;
+    }
+
+  status = krb5_copy_principal(context, ticket->enc_part2->client, &client);
+  if (status)
+    {
+      client_reply(cl, status);
+      com_err(whoami, status, " (krb5_copy_principal failed)");
+      goto out;
+    }
+
+  /* Always convert to krb4 style principal name for now. */
+  status = krb5_524_conv_principal(context, client, name, inst, realm);
+  if (status)
+    {
+      client_reply(cl, status);
+      com_err(whoami, status, " (krb5_524_conv_principal failed)");
+      goto out;
+    }
+  status = set_client(cl, mr_kname_unparse(name, inst, realm), name, inst,
+                     realm);
+
+  strncpy(cl->entity, cl->req.mr_argv[1], sizeof(cl->entity) - 1);
+  cl->entity[sizeof(cl->entity) - 1] = 0;
+
+  memset(&ticket, 0, sizeof(ticket));  /* Clean up session key, etc. */
+
+  com_err(whoami, 0, "krb5 auth to %s using %s, uid %d cid %d",
+         cl->clname, cl->entity, cl->users_id, cl->client_id);
+
+  if (status != MR_SUCCESS || cl->users_id != 0)
+    client_reply(cl, status);
+  else
+    client_reply(cl, MR_USER_AUTH);
+
+ out:
+  if (client)
+    krb5_free_principal(context, client);
+  if (server)
+    krb5_free_principal(context, server);
+  if (ticket)
+    krb5_free_ticket(context, ticket);
+  if (auth_con)
+    krb5_auth_con_free(context, auth_con);
+  return;
+}

diff --git a/server/mr_scall.c b/server/mr_scall.c
index a3f1fa846e10952a8cc1b40e3015a9f42e1e2a99..4604334149e1a03e0caaf7506cbe55e1b7f90bbc 100644 (file)
--- a/server/mr_scall.c
+++ b/server/mr_scall.c
@@ -53,6 +53,7 @@ char *procnames[] = {
   "motd",
   "proxy",
   "version",
+  "auth_krb5",
 };
 
 int newqueries;
@@ -128,6 +129,11 @@ void client_read(client *cl)
     case MR_SETVERSION:
       do_version(cl);
       break;
+
+    case MR_KRB5_AUTH:
+      do_krb5_auth(cl);
+      break;
+
     }
 
 out:

diff --git a/server/mr_server.h b/server/mr_server.h
index 4c11f46fbb218702390000db96129325b5fed51f..ef78aef8672989f13242e3d9d4fc145743a7c07d 100644 (file)
--- a/server/mr_server.h
+++ b/server/mr_server.h
@@ -15,6 +15,7 @@
 #include <stdarg.h>
 
 #include <krb.h>
+#include <krb5.h>
 
 enum clstate { CL_ACCEPTING, CL_ACTIVE, CL_CLOSING };
 
@@ -114,6 +115,7 @@ void clist_delete(client *cp);
 /* prototypes from mr_sauth.c */
 void do_auth(client *cl);
 void do_proxy(client *cl);
+void do_krb5_auth(client *cl);
 
 /* prototypes from mr_scall.c */
 void do_client(client *cl);

diff --git a/update/Makefile.in b/update/Makefile.in
index 31a1abbc1526052e8ed15571143a514e7a15baba..0181ead075225e0b20ca7b9b65b48b975b6afc99 100644 (file)
--- a/update/Makefile.in
+++ b/update/Makefile.in
@@ -23,7 +23,7 @@ exec_prefix=@exec_prefix@
 bindir=@bindir@
 sbindir=@sbindir@
 
-SOBJS= auth_002.o checksum.o config.o exec_002.o get_file.o \
+SOBJS= auth_002.o auth_003.o checksum.o config.o exec_002.o get_file.o \
        update_server.o xfer_002.o xfer_003.o sendrecv.o
 COBJS= update_test.o checksum.o client.o send_file.o ticket.o sendrecv.o
 

diff --git a/update/auth_003.c b/update/auth_003.c
new file mode 100644 (file)
index 0000000..acea5d6
--- /dev/null
+++ b/update/auth_003.c
@@ -0,0 +1,172 @@
+/* $Id$
+ *
+ * Copyright (C) 1988-1998 by the Massachusetts Institute of Technology.
+ * For copying and distribution information, please see the file
+ * <mit-copyright.h>.
+ */
+
+#include <mit-copyright.h>
+#include <moira.h>
+#include "update_server.h"
+
+#include <sys/utsname.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+
+#include <krb.h>
+#include <krb5.h>
+
+RCSID("$Header$");
+
+static char service[] = "host";
+static char master[] = "sms";
+static char qmark[] = "???";
+
+/*
+ * authentication request auth_003:
+ *
+ * >>> (STRING) "auth_003"
+ * <<< (int) 0
+ * >>> (STRING) ticket
+ * <<< (int) code
+ *
+ */
+
+void auth_003(int conn, char *str)
+{
+  krb5_context context = NULL;
+  krb5_auth_context auth_con = NULL;
+  krb5_data auth;
+  krb5_principal server = NULL, client = NULL;
+  krb5_ticket *ticket;
+  char *p, *first, *data;
+  char name[ANAME_SZ], inst[INST_SZ], realm[REALM_SZ];
+  char aname[ANAME_SZ], ainst[INST_SZ], arealm[REALM_SZ];
+  size_t size;
+  long code;
+  struct utsname uts;
+
+  ticket = NULL;
+
+  send_ok(conn);
+
+  recv_string(conn, &data, &size);
+  auth.data = malloc(size);
+  if (!auth.data)
+    goto out;
+  memcpy(auth.data, data, size);
+  free(data);
+  auth.length = size;
+
+  code = krb5_init_context(&context);
+  if (code)
+    {
+      com_err(whoami, code, "Initializing context");
+      send_int(conn, code);
+      goto out;
+    }
+
+  code = krb5_auth_con_init(context, &auth_con);
+  if (code)
+    {
+      com_err(whoami, code, "Initializing auth context");
+      send_int(conn, code);
+      goto out;
+    }
+
+  if (uname(&uts) < 0)
+    {
+      com_err(whoami, errno, "Unable to get local hostname");
+      send_int(conn, errno);
+      goto out;
+    }
+
+  code = krb5_sname_to_principal(context, uts.nodename, service,
+                                KRB5_NT_SRV_HST, &server);
+
+  if (code)
+    {
+      com_err(whoami, code, "(krb5_sname_to_principal failed)");
+      send_int(conn, code);
+      goto out;
+    }
+
+  code = krb5_rd_req(context, &auth_con, &auth, server, NULL, NULL, &ticket);
+
+  if (code)
+    {
+      strcpy(name, qmark);
+      strcpy(inst, qmark);
+      strcpy(realm, qmark);
+      com_err(whoami, code, "auth for %s.%s@%s failed", name, inst, realm);
+      send_int(conn, code);
+      goto out;
+    }
+
+  code = krb5_copy_principal(context, ticket->enc_part2->client, &client);
+  if (code)
+    {
+      com_err(whoami, code, "(krb5_copy_principal failed)");
+      send_int(conn, code);
+      goto out;
+    }
+
+  code = krb5_524_conv_principal(context, client, name, inst, realm);
+  if (code)
+    {
+      com_err(whoami, code, "(krb5_524_conv_principal_failed)");
+      send_int(conn, code);
+      goto out;
+    }
+
+  /* If there is an auth record in the config file matching the
+   * authenticator we received, then accept it.  If there's no
+   * auth record, assume [master]@[local realm].
+   */
+  if ((first = p = config_lookup("auth")))
+    {
+      do
+       {
+         kname_parse(aname, ainst, arealm, p);
+         if (strcmp(aname, name) ||
+             strcmp(ainst, inst) ||
+             strcmp(arealm, realm))
+           p = config_lookup("auth");
+         else
+           p = first;
+       }
+      while (p != first);
+    }
+  else 
+    {
+      strcpy(aname, master);
+      strcpy(ainst, "");
+      if (krb_get_lrealm(arealm, 1))
+       strcpy(arealm, KRB_REALM);
+    }
+  code = EPERM;
+  if (strcmp(aname, name) ||
+      strcmp(ainst, inst) ||
+      strcmp(arealm, realm))
+    {
+      com_err(whoami, code, "auth for %s.%s@%s failed", name, inst, realm);
+      send_int(conn, code);
+      goto out;
+    }
+  send_ok(conn);
+  have_authorization = 1;
+
+ out:
+  if (client)
+    krb5_free_principal(context, client);
+  if (server)
+    krb5_free_principal(context, server);
+  if (ticket)
+    krb5_free_ticket(context, ticket);
+  krb5_free_data_contents(context, &auth);
+  if (auth_con)
+    krb5_auth_con_free(context, auth_con);
+  return;
+}

diff --git a/update/client.c b/update/client.c
index 160d6d1d28cd7bb4c09f6003e144602990485fda..1f6bbdb0ddd3d6475d677f501a0ed89cf7d52f64 100644 (file)
--- a/update/client.c
+++ b/update/client.c
@@ -19,11 +19,55 @@
 
 #include <des.h>
 #include <krb.h>
+#include <krb5.h>
 
 RCSID("$Header$");
 
 extern des_cblock session;
 extern char *whoami;
+extern krb5_context context;
+
+int mr_send_krb5_auth(int conn, char *host_name)
+{
+  krb5_data auth;
+  int code;
+  long response;
+
+  memset(&auth, 0, sizeof(auth));
+
+  code = get_mr_krb5_update_ticket(host_name, &auth);
+  if (code)
+    goto out;
+  code = send_string(conn, "AUTH_003", 9);
+  if (code)
+    goto out;
+  code = recv_int(conn, &response);
+  if (code)
+    goto out;
+  if (response)
+    {
+      /* Talking to a server that doesn't do AUTH_003 */
+      krb5_free_data_contents(context, &auth);
+      return response;
+    }
+  code = send_string(conn, (char *)auth.data, auth.length);
+  if (code)
+    goto out;
+  code = recv_int(conn, &response);
+  if (code)
+    goto out;
+  if (response)
+    {
+      krb5_free_data_contents(context, &auth);
+      return response;
+    }
+
+  return MR_SUCCESS;
+
+ out:
+  krb5_free_data_contents(context, &auth);
+  return code;
+}
 
 int mr_send_auth(int conn, char *host_name)
 {

diff --git a/update/ticket.c b/update/ticket.c
index a04a5214ff7a21384af128f74633163d9dc646e6..b886631cb099f451c3efe81617c88dd1dd0c77ae 100644 (file)
--- a/update/ticket.c
+++ b/update/ticket.c
@@ -14,6 +14,7 @@
 #include <string.h>
 
 #include <krb.h>
+#include <krb5.h>
 #include <update.h>
 
 RCSID("$Header$");
@@ -22,9 +23,39 @@ static char realm[REALM_SZ];
 static char master[INST_SZ] = "sms";
 static char service[ANAME_SZ] = "rcmd";
 des_cblock session;
+krb5_context context = NULL;
 
 static int get_mr_tgt(void);
 
+int get_mr_krb5_update_ticket(char *host, krb5_data auth)
+{
+  krb5_auth_context auth_con = NULL;
+  krb5_ccache ccache = NULL;
+  krb5_error_code code;
+
+  code = krb5_init_context(&context);
+  if (code)
+    goto out;
+
+  code = krb5_auth_con_init(context, &auth_con);
+  if (code)
+    goto out;
+
+  code = krb5_cc_default(context, &ccache);
+  if (code)
+    goto out;
+
+  code = krb5_mk_req(context, &auth_con, NULL, "host", host, NULL, ccache,
+                    &auth);
+
+ out:
+  if (ccache)
+    krb5_cc_close(context, ccache);
+  if (auth_con)
+    krb5_auth_con_free(context, auth_con);
+  return code;
+}
+
 int get_mr_update_ticket(char *host, KTEXT ticket)
 {
   int code, pass;

diff --git a/update/update_server.c b/update/update_server.c
index 41bcbda4d227d03488f4288e4f7f5853cd6be146..985700d15862902a288cda9473f9a437aa1bd6c4 100644 (file)
--- a/update/update_server.c
+++ b/update/update_server.c
@@ -45,6 +45,7 @@ struct _dt {
   void (*proc)(int, char *);
 } dispatch_table[] = {
   { "AUTH_002", auth_002 },
+  { "AUTH_003", auth_003 },
   { "XFER_002", xfer_002 },
   { "XFER_003", xfer_003 },
   { "EXEC_002", exec_002 },

diff --git a/update/update_server.h b/update/update_server.h
index a61307942268cfdf7af67d5d34a3d2dd2caa3eb1..276dbaee3d2dc0f7bbc48eca88c06defda9cad67 100644 (file)
--- a/update/update_server.h
+++ b/update/update_server.h
@@ -1,6 +1,7 @@
 /* prototypes for the update_server */
 
 void auth_002(int conn, char *str);
+void auth_003(int conn, char *str);
 void exec_002(int conn, char *str);
 void xfer_002(int conn, char *str);
 void xfer_003(int conn, char *str);

diff --git a/update/update_test.c b/update/update_test.c
index 4511acfbb288bd394fe762dcfc27894979af0353..d3f957328dfd8c7d0291170104de0c4bb9e3e845 100644 (file)
--- a/update/update_test.c
+++ b/update/update_test.c
@@ -39,7 +39,9 @@ int main(int argc, char **argv)
       exit(1);
     }
 
-  code = mr_send_auth(conn, host);
+  code = mr_send_krb5_auth(conn, host);
+  if (code)
+    code = mr_send_auth(conn, host);
   if (code)
     com_err(whoami, code, "attempting authorization");
 

diff --git a/webmoira/moirai.c b/webmoira/moirai.c
index 18cebb5f0a496c9719b5453289279821847c6647..cace17fec1b86ae6553a02ca61448bc2bdf13f95 100644 (file)
--- a/webmoira/moirai.c
+++ b/webmoira/moirai.c
@@ -89,7 +89,7 @@ JNIEXPORT void JNICALL Java_mit_moira_MoiraConnectInternal_proxy(JNIEnv *env,
 JNIEXPORT void JNICALL Java_mit_moira_MoiraConnectInternal_auth(JNIEnv *env,
                                                      jclass Class) {
     int status;
-    status = mr_auth("JavaInterface");
+    status = mr_krb5_auth("JavaInterface");
     if (status != MR_SUCCESS) throwMoiraException(env, status);
     return;
 }