[openssh.git] / auth-krb5.c

/*
 *    Kerberos v5 authentication and ticket-passing routines.
 *
 * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
 */
/*
 * Copyright (c) 2002 Daniel Kouril.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$OpenBSD: auth-krb5.c,v 1.10 2002/11/21 23:03:51 deraadt Exp $");

#include "ssh.h"
#include "ssh1.h"
#include "packet.h"
#include "xmalloc.h"
#include "log.h"
#include "servconf.h"
#include "uidswap.h"
#include "auth.h"

#ifdef KRB5

#include <krb5.h>
#ifndef HEIMDAL
#define krb5_get_err_text(context,code) error_message(code)
#endif /* !HEIMDAL */

extern ServerOptions	 options;

static int
krb5_init(void *context)
{
	Authctxt *authctxt = (Authctxt *)context;
	krb5_error_code problem;
	static int cleanup_registered = 0;

	if (authctxt->krb5_ctx == NULL) {
		problem = krb5_init_context(&authctxt->krb5_ctx);
		if (problem)
			return (problem);
		krb5_init_ets(authctxt->krb5_ctx);
	}
	if (!cleanup_registered) {
		fatal_add_cleanup(krb5_cleanup_proc, authctxt);
		cleanup_registered = 1;
	}
	return (0);
}

/*
 * Try krb5 authentication. server_user is passed for logging purposes
 * only, in auth is received ticket, in client is returned principal
 * from the ticket
 */
int
auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *reply)
{
	krb5_error_code problem;
	krb5_principal server;
	krb5_ticket *ticket;
	int fd, ret;

	ret = 0;
	server = NULL;
	ticket = NULL;
	reply->length = 0;

	problem = krb5_init(authctxt);
	if (problem)
		goto err;

	problem = krb5_auth_con_init(authctxt->krb5_ctx,
	    &authctxt->krb5_auth_ctx);
	if (problem)
		goto err;

	fd = packet_get_connection_in();
#ifdef HEIMDAL
	problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
	    authctxt->krb5_auth_ctx, &fd);
#else
	problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx, 
	    authctxt->krb5_auth_ctx,fd,
	    KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR |
	    KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
#endif
	if (problem)
		goto err;

	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	    KRB5_NT_SRV_HST, &server);
	if (problem)
		goto err;

	problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
	    auth, server, NULL, NULL, &ticket);
	if (problem)
		goto err;

#ifdef HEIMDAL
	problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
	    &authctxt->krb5_user);
#else
	problem = krb5_copy_principal(authctxt->krb5_ctx, 
				      ticket->enc_part2->client,
				      &authctxt->krb5_user);
#endif
	if (problem)
		goto err;

	/* if client wants mutual auth */
	problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    reply);
	if (problem)
		goto err;

	/* Check .k5login authorization now. */
	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	    authctxt->pw->pw_name))
		goto err;

	if (client)
		krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
		    client);

	ret = 1;
 err:
	if (server)
		krb5_free_principal(authctxt->krb5_ctx, server);
	if (ticket)
		krb5_free_ticket(authctxt->krb5_ctx, ticket);
	if (!ret && reply->length) {
		xfree(reply->data);
		memset(reply, 0, sizeof(*reply));
	}

	if (problem) {
		if (authctxt->krb5_ctx != NULL)
			debug("Kerberos v5 authentication failed: %s",
			    krb5_get_err_text(authctxt->krb5_ctx, problem));
		else
			debug("Kerberos v5 authentication failed: %d",
			    problem);
	}

	return (ret);
}

int
auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt)
{
	krb5_error_code problem;
	krb5_ccache ccache = NULL;
	char *pname;
	krb5_creds **creds;

	if (authctxt->pw == NULL || authctxt->krb5_user == NULL)
		return (0);

	temporarily_use_uid(authctxt->pw);

#ifdef HEIMDAL
	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
#else
{
	char ccname[40];
	int tmpfd;
	
	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	
	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
		logit("mkstemp(): %.100s", strerror(errno));
		problem = errno;
		goto fail;
	}
	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
		logit("fchmod(): %.100s", strerror(errno));
		close(tmpfd);
		problem = errno;
		goto fail;
	}
	close(tmpfd);
	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
}
#endif
	if (problem)
		goto fail;

	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
	    authctxt->krb5_user);
	if (problem)
		goto fail;

#ifdef HEIMDAL
	problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    ccache, tgt);
	if (problem)
		goto fail;
#else
	problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    tgt, &creds, NULL);
	if (problem)
		goto fail;
	problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
	if (problem)
		goto fail;
#endif

	authctxt->krb5_fwd_ccache = ccache;
	ccache = NULL;

	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);

	problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	    &pname);
	if (problem)
		goto fail;

	debug("Kerberos v5 TGT accepted (%s)", pname);

	restore_uid();

	return (1);

 fail:
	if (problem)
		debug("Kerberos v5 TGT passing failed: %s",
		    krb5_get_err_text(authctxt->krb5_ctx, problem));
	if (ccache)
		krb5_cc_destroy(authctxt->krb5_ctx, ccache);

	restore_uid();

	return (0);
}

int
auth_krb5_password(Authctxt *authctxt, const char *password)
{
#ifndef HEIMDAL
	krb5_creds creds;
	krb5_principal server;
	char ccname[40];
	int tmpfd;
#endif	
	krb5_error_code problem;

	if (authctxt->pw == NULL)
		return (0);

	temporarily_use_uid(authctxt->pw);

	problem = krb5_init(authctxt);
	if (problem)
		goto out;

	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
		    &authctxt->krb5_user);
	if (problem)
		goto out;

#ifdef HEIMDAL
	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops,
	    &authctxt->krb5_fwd_ccache);
	if (problem)
		goto out;

	problem = krb5_cc_initialize(authctxt->krb5_ctx,
	    authctxt->krb5_fwd_ccache, authctxt->krb5_user);
	if (problem)
		goto out;

	restore_uid();
	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
	    authctxt->krb5_fwd_ccache, password, 1, NULL);
	temporarily_use_uid(authctxt->pw);

	if (problem)
		goto out;

#else
	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
	    authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
	if (problem)
		goto out;

	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	    KRB5_NT_SRV_HST, &server);
	if (problem)
		goto out;

	restore_uid();
	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
	    NULL, NULL, NULL);
	krb5_free_principal(authctxt->krb5_ctx, server);
	temporarily_use_uid(authctxt->pw);
	if (problem)
		goto out;
	
	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, 
			  authctxt->pw->pw_name)) {
		problem = -1;
		goto out;
	} 

	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	
	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
		logit("mkstemp(): %.100s", strerror(errno));
		problem = errno;
		goto out;
	}
	
	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
		logit("fchmod(): %.100s", strerror(errno));
		close(tmpfd);
		problem = errno;
		goto out;
	}
	close(tmpfd);

	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
	if (problem)
		goto out;

	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
				     authctxt->krb5_user);
	if (problem)
		goto out;
				
	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
				 &creds);
	if (problem)
		goto out;
#endif		

	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);

 out:
	restore_uid();

	if (problem) {
		if (authctxt->krb5_ctx != NULL && problem!=-1)
			debug("Kerberos password authentication failed: %s",
			    krb5_get_err_text(authctxt->krb5_ctx, problem));
		else
			debug("Kerberos password authentication failed: %d",
			    problem);

		krb5_cleanup_proc(authctxt);

		if (options.kerberos_or_local_passwd)
			return (-1);
		else
			return (0);
	}
	return (1);
}

void
krb5_cleanup_proc(void *context)
{
	Authctxt *authctxt = (Authctxt *)context;

	debug("krb5_cleanup_proc called");
	if (authctxt->krb5_fwd_ccache) {
		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
		authctxt->krb5_fwd_ccache = NULL;
	}
	if (authctxt->krb5_user) {
		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
		authctxt->krb5_user = NULL;
	}
	if (authctxt->krb5_auth_ctx) {
		krb5_auth_con_free(authctxt->krb5_ctx,
		    authctxt->krb5_auth_ctx);
		authctxt->krb5_auth_ctx = NULL;
	}
	if (authctxt->krb5_ctx) {
		krb5_free_context(authctxt->krb5_ctx);
		authctxt->krb5_ctx = NULL;
	}
}

#endif /* KRB5 */
Commit	Line	Data
aa9f6a6e	1	/*
aa9f6a6e	2	* Kerberos v5 authentication and ticket-passing routines.
762715ce	3	*
aa9f6a6e	4	* $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
aa9f6a6e	5	*/
bb15f28b	6	/*
	7	* Copyright (c) 2002 Daniel Kouril. All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	*
	18	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	19	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	20	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	21	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	22	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	23	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	24	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	25	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	26	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	27	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	28	*/
aa9f6a6e	29
aa9f6a6e	30	#include "includes.h"
b77a87e5	31	RCSID("$OpenBSD: auth-krb5.c,v 1.10 2002/11/21 23:03:51 deraadt Exp $");
93c3b6de	32
aa9f6a6e	33	#include "ssh.h"
	34	#include "ssh1.h"
	35	#include "packet.h"
	36	#include "xmalloc.h"
	37	#include "log.h"
	38	#include "servconf.h"
	39	#include "uidswap.h"
	40	#include "auth.h"
	41
	42	#ifdef KRB5
751092f9	43
aa9f6a6e	44	#include <krb5.h>
12928e80	45	#ifndef HEIMDAL
	46	#define krb5_get_err_text(context,code) error_message(code)
	47	#endif /* !HEIMDAL */
aa9f6a6e	48
	49	extern ServerOptions options;
	50
	51	static int
	52	krb5_init(void *context)
	53	{
	54	Authctxt authctxt = (Authctxt )context;
	55	krb5_error_code problem;
	56	static int cleanup_registered = 0;
a0105740	57
aa9f6a6e	58	if (authctxt->krb5_ctx == NULL) {
	59	problem = krb5_init_context(&authctxt->krb5_ctx);
	60	if (problem)
	61	return (problem);
	62	krb5_init_ets(authctxt->krb5_ctx);
	63	}
	64	if (!cleanup_registered) {
	65	fatal_add_cleanup(krb5_cleanup_proc, authctxt);
	66	cleanup_registered = 1;
	67	}
	68	return (0);
	69	}
	70
	71	/*
	72	* Try krb5 authentication. server_user is passed for logging purposes
	73	* only, in auth is received ticket, in client is returned principal
	74	* from the ticket
	75	*/
a0105740	76	int
696f6bef	77	auth_krb5(Authctxt authctxt, krb5_data auth, char *client, krb5_data reply)
aa9f6a6e	78	{
	79	krb5_error_code problem;
	80	krb5_principal server;
aa9f6a6e	81	krb5_ticket *ticket;
ede8cea6	82	int fd, ret;
	83
	84	ret = 0;
aa9f6a6e	85	server = NULL;
aa9f6a6e	86	ticket = NULL;
696f6bef	87	reply->length = 0;
a0105740	88
aa9f6a6e	89	problem = krb5_init(authctxt);
a0105740	90	if (problem)
aa9f6a6e	91	goto err;
a0105740	92
aa9f6a6e	93	problem = krb5_auth_con_init(authctxt->krb5_ctx,
	94	&authctxt->krb5_auth_ctx);
	95	if (problem)
	96	goto err;
a0105740	97
aa9f6a6e	98	fd = packet_get_connection_in();
12928e80	99	#ifdef HEIMDAL
aa9f6a6e	100	problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
aa9f6a6e	101	authctxt->krb5_auth_ctx, &fd);
12928e80	102	#else
	103	problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx,
	104	authctxt->krb5_auth_ctx,fd,
	105	KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR \|
	106	KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
	107	#endif
aa9f6a6e	108	if (problem)
aa9f6a6e	109	goto err;
a0105740	110
b77a87e5	111	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
aa9f6a6e	112	KRB5_NT_SRV_HST, &server);
	113	if (problem)
	114	goto err;
a0105740	115
aa9f6a6e	116	problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
	117	auth, server, NULL, NULL, &ticket);
	118	if (problem)
	119	goto err;
a0105740	120
12928e80	121	#ifdef HEIMDAL
aa9f6a6e	122	problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
aa9f6a6e	123	&authctxt->krb5_user);
12928e80	124	#else
	125	problem = krb5_copy_principal(authctxt->krb5_ctx,
	126	ticket->enc_part2->client,
	127	&authctxt->krb5_user);
	128	#endif
aa9f6a6e	129	if (problem)
aa9f6a6e	130	goto err;
a0105740	131
aa9f6a6e	132	/* if client wants mutual auth */
aa9f6a6e	133	problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
696f6bef	134	reply);
aa9f6a6e	135	if (problem)
aa9f6a6e	136	goto err;
a0105740	137
aa9f6a6e	138	/* Check .k5login authorization now. */
	139	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	140	authctxt->pw->pw_name))
	141	goto err;
a0105740	142
aa9f6a6e	143	if (client)
	144	krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	145	client);
a0105740	146
ede8cea6	147	ret = 1;
aa9f6a6e	148	err:
	149	if (server)
	150	krb5_free_principal(authctxt->krb5_ctx, server);
	151	if (ticket)
	152	krb5_free_ticket(authctxt->krb5_ctx, ticket);
696f6bef	153	if (!ret && reply->length) {
	154	xfree(reply->data);
	155	memset(reply, 0, sizeof(*reply));
	156	}
a0105740	157
c12337d9	158	if (problem) {
	159	if (authctxt->krb5_ctx != NULL)
	160	debug("Kerberos v5 authentication failed: %s",
	161	krb5_get_err_text(authctxt->krb5_ctx, problem));
	162	else
	163	debug("Kerberos v5 authentication failed: %d",
	164	problem);
	165	}
ede8cea6	166
ede8cea6	167	return (ret);
aa9f6a6e	168	}
	169
	170	int
	171	auth_krb5_tgt(Authctxt authctxt, krb5_data tgt)
	172	{
	173	krb5_error_code problem;
	174	krb5_ccache ccache = NULL;
	175	char *pname;
12928e80	176	krb5_creds **creds;
a0105740	177
aa9f6a6e	178	if (authctxt->pw == NULL \|\| authctxt->krb5_user == NULL)
aa9f6a6e	179	return (0);
a0105740	180
aa9f6a6e	181	temporarily_use_uid(authctxt->pw);
a0105740	182
12928e80	183	#ifdef HEIMDAL
aa9f6a6e	184	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
12928e80	185	#else
	186	{
	187	char ccname[40];
	188	int tmpfd;
	189
	190	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	191
	192	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
bbe88b6d	193	logit("mkstemp(): %.100s", strerror(errno));
12928e80	194	problem = errno;
	195	goto fail;
	196	}
	197	if (fchmod(tmpfd,S_IRUSR \| S_IWUSR) == -1) {
bbe88b6d	198	logit("fchmod(): %.100s", strerror(errno));
12928e80	199	close(tmpfd);
	200	problem = errno;
	201	goto fail;
	202	}
	203	close(tmpfd);
	204	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
	205	}
	206	#endif
aa9f6a6e	207	if (problem)
aa9f6a6e	208	goto fail;
a0105740	209
aa9f6a6e	210	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
	211	authctxt->krb5_user);
	212	if (problem)
	213	goto fail;
a0105740	214
12928e80	215	#ifdef HEIMDAL
aa9f6a6e	216	problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	217	ccache, tgt);
	218	if (problem)
	219	goto fail;
12928e80	220	#else
	221	problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	222	tgt, &creds, NULL);
	223	if (problem)
	224	goto fail;
	225	problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
	226	if (problem)
	227	goto fail;
	228	#endif
a0105740	229
aa9f6a6e	230	authctxt->krb5_fwd_ccache = ccache;
aa9f6a6e	231	ccache = NULL;
a0105740	232
aa9f6a6e	233	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
a0105740	234
aa9f6a6e	235	problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	236	&pname);
	237	if (problem)
	238	goto fail;
a0105740	239
aa9f6a6e	240	debug("Kerberos v5 TGT accepted (%s)", pname);
a0105740	241
aa9f6a6e	242	restore_uid();
a0105740	243
aa9f6a6e	244	return (1);
a0105740	245
aa9f6a6e	246	fail:
	247	if (problem)
	248	debug("Kerberos v5 TGT passing failed: %s",
	249	krb5_get_err_text(authctxt->krb5_ctx, problem));
	250	if (ccache)
	251	krb5_cc_destroy(authctxt->krb5_ctx, ccache);
a0105740	252
aa9f6a6e	253	restore_uid();
a0105740	254
aa9f6a6e	255	return (0);
	256	}
	257
	258	int
	259	auth_krb5_password(Authctxt authctxt, const char password)
	260	{
12928e80	261	#ifndef HEIMDAL
	262	krb5_creds creds;
	263	krb5_principal server;
	264	char ccname[40];
	265	int tmpfd;
	266	#endif
aa9f6a6e	267	krb5_error_code problem;
a0105740	268
aa9f6a6e	269	if (authctxt->pw == NULL)
aa9f6a6e	270	return (0);
a0105740	271
aa9f6a6e	272	temporarily_use_uid(authctxt->pw);
a0105740	273
aa9f6a6e	274	problem = krb5_init(authctxt);
	275	if (problem)
	276	goto out;
a0105740	277
aa9f6a6e	278	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
	279	&authctxt->krb5_user);
	280	if (problem)
	281	goto out;
a0105740	282
12928e80	283	#ifdef HEIMDAL
aa9f6a6e	284	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops,
	285	&authctxt->krb5_fwd_ccache);
	286	if (problem)
	287	goto out;
a0105740	288
aa9f6a6e	289	problem = krb5_cc_initialize(authctxt->krb5_ctx,
	290	authctxt->krb5_fwd_ccache, authctxt->krb5_user);
	291	if (problem)
	292	goto out;
a0105740	293
a0105740	294	restore_uid();
aa9f6a6e	295	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
aa9f6a6e	296	authctxt->krb5_fwd_ccache, password, 1, NULL);
a0105740	297	temporarily_use_uid(authctxt->pw);
a0105740	298
aa9f6a6e	299	if (problem)
aa9f6a6e	300	goto out;
a0105740	301
12928e80	302	#else
	303	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
	304	authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
	305	if (problem)
	306	goto out;
	307
	308	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	309	KRB5_NT_SRV_HST, &server);
	310	if (problem)
	311	goto out;
	312
	313	restore_uid();
	314	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
	315	NULL, NULL, NULL);
	316	krb5_free_principal(authctxt->krb5_ctx, server);
	317	temporarily_use_uid(authctxt->pw);
	318	if (problem)
	319	goto out;
	320
	321	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	322	authctxt->pw->pw_name)) {
875ec275	323	problem = -1;
12928e80	324	goto out;
	325	}
	326
	327	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	328
	329	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
bbe88b6d	330	logit("mkstemp(): %.100s", strerror(errno));
12928e80	331	problem = errno;
	332	goto out;
	333	}
	334
	335	if (fchmod(tmpfd,S_IRUSR \| S_IWUSR) == -1) {
bbe88b6d	336	logit("fchmod(): %.100s", strerror(errno));
12928e80	337	close(tmpfd);
	338	problem = errno;
	339	goto out;
	340	}
	341	close(tmpfd);
	342
	343	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
	344	if (problem)
	345	goto out;
	346
	347	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
	348	authctxt->krb5_user);
	349	if (problem)
	350	goto out;
	351
	352	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
	353	&creds);
	354	if (problem)
	355	goto out;
	356	#endif
	357
aa9f6a6e	358	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
a0105740	359
aa9f6a6e	360	out:
aa9f6a6e	361	restore_uid();
a0105740	362
aa9f6a6e	363	if (problem) {
12928e80	364	if (authctxt->krb5_ctx != NULL && problem!=-1)
c12337d9	365	debug("Kerberos password authentication failed: %s",
	366	krb5_get_err_text(authctxt->krb5_ctx, problem));
	367	else
	368	debug("Kerberos password authentication failed: %d",
	369	problem);
a0105740	370
aa9f6a6e	371	krb5_cleanup_proc(authctxt);
a0105740	372
aa9f6a6e	373	if (options.kerberos_or_local_passwd)
	374	return (-1);
	375	else
	376	return (0);
	377	}
	378	return (1);
	379	}
	380
	381	void
	382	krb5_cleanup_proc(void *context)
	383	{
	384	Authctxt authctxt = (Authctxt )context;
a0105740	385
aa9f6a6e	386	debug("krb5_cleanup_proc called");
	387	if (authctxt->krb5_fwd_ccache) {
	388	krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
	389	authctxt->krb5_fwd_ccache = NULL;
	390	}
	391	if (authctxt->krb5_user) {
	392	krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
	393	authctxt->krb5_user = NULL;
	394	}
	395	if (authctxt->krb5_auth_ctx) {
	396	krb5_auth_con_free(authctxt->krb5_ctx,
	397	authctxt->krb5_auth_ctx);
	398	authctxt->krb5_auth_ctx = NULL;
	399	}
	400	if (authctxt->krb5_ctx) {
	401	krb5_free_context(authctxt->krb5_ctx);
	402	authctxt->krb5_ctx = NULL;
	403	}
	404	}
	405
	406	#endif /* KRB5 */