[openssh.git] / auth-krb5.c

/*
 *    Kerberos v5 authentication and ticket-passing routines.
 *
 * $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
 */
/*
 * Copyright (c) 2002 Daniel Kouril.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$OpenBSD: auth-krb5.c,v 1.10 2002/11/21 23:03:51 deraadt Exp $");

#include "ssh.h"
#include "ssh1.h"
#include "packet.h"
#include "xmalloc.h"
#include "log.h"
#include "servconf.h"
#include "uidswap.h"
#include "auth.h"

#ifdef KRB5
#include <krb5.h>
#ifndef HEIMDAL
#define krb5_get_err_text(context,code) error_message(code)
#endif /* !HEIMDAL */

extern ServerOptions	 options;

static int
krb5_init(void *context)
{
	Authctxt *authctxt = (Authctxt *)context;
	krb5_error_code problem;
	static int cleanup_registered = 0;

	if (authctxt->krb5_ctx == NULL) {
		problem = krb5_init_context(&authctxt->krb5_ctx);
		if (problem)
			return (problem);
		krb5_init_ets(authctxt->krb5_ctx);
	}
	if (!cleanup_registered) {
		fatal_add_cleanup(krb5_cleanup_proc, authctxt);
		cleanup_registered = 1;
	}
	return (0);
}

/*
 * Try krb5 authentication. server_user is passed for logging purposes
 * only, in auth is received ticket, in client is returned principal
 * from the ticket
 */
int
auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *reply)
{
	krb5_error_code problem;
	krb5_principal server;
	krb5_ticket *ticket;
	int fd, ret;

	ret = 0;
	server = NULL;
	ticket = NULL;
	reply->length = 0;

	problem = krb5_init(authctxt);
	if (problem)
		goto err;

	problem = krb5_auth_con_init(authctxt->krb5_ctx,
	    &authctxt->krb5_auth_ctx);
	if (problem)
		goto err;

	fd = packet_get_connection_in();
#ifdef HEIMDAL
	problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
	    authctxt->krb5_auth_ctx, &fd);
#else
	problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx, 
	    authctxt->krb5_auth_ctx,fd,
	    KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR |
	    KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
#endif
	if (problem)
		goto err;

	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	    KRB5_NT_SRV_HST, &server);
	if (problem)
		goto err;

	problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
	    auth, server, NULL, NULL, &ticket);
	if (problem)
		goto err;

#ifdef HEIMDAL
	problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
	    &authctxt->krb5_user);
#else
	problem = krb5_copy_principal(authctxt->krb5_ctx, 
				      ticket->enc_part2->client,
				      &authctxt->krb5_user);
#endif
	if (problem)
		goto err;

	/* if client wants mutual auth */
	problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    reply);
	if (problem)
		goto err;

	/* Check .k5login authorization now. */
	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	    authctxt->pw->pw_name))
		goto err;

	if (client)
		krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
		    client);

	ret = 1;
 err:
	if (server)
		krb5_free_principal(authctxt->krb5_ctx, server);
	if (ticket)
		krb5_free_ticket(authctxt->krb5_ctx, ticket);
	if (!ret && reply->length) {
		xfree(reply->data);
		memset(reply, 0, sizeof(*reply));
	}

	if (problem) {
		if (authctxt->krb5_ctx != NULL)
			debug("Kerberos v5 authentication failed: %s",
			    krb5_get_err_text(authctxt->krb5_ctx, problem));
		else
			debug("Kerberos v5 authentication failed: %d",
			    problem);
	}

	return (ret);
}

int
auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt)
{
	krb5_error_code problem;
	krb5_ccache ccache = NULL;
	char *pname;
	krb5_creds **creds;

	if (authctxt->pw == NULL || authctxt->krb5_user == NULL)
		return (0);

	temporarily_use_uid(authctxt->pw);

#ifdef HEIMDAL
	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
#else
{
	char ccname[40];
	int tmpfd;
	
	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	
	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
		log("mkstemp(): %.100s", strerror(errno));
		problem = errno;
		goto fail;
	}
	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
		log("fchmod(): %.100s", strerror(errno));
		close(tmpfd);
		problem = errno;
		goto fail;
	}
	close(tmpfd);
	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
}
#endif
	if (problem)
		goto fail;

	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
	    authctxt->krb5_user);
	if (problem)
		goto fail;

#ifdef HEIMDAL
	problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    ccache, tgt);
	if (problem)
		goto fail;
#else
	problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	    tgt, &creds, NULL);
	if (problem)
		goto fail;
	problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
	if (problem)
		goto fail;
#endif

	authctxt->krb5_fwd_ccache = ccache;
	ccache = NULL;

	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);

	problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	    &pname);
	if (problem)
		goto fail;

	debug("Kerberos v5 TGT accepted (%s)", pname);

	restore_uid();

	return (1);

 fail:
	if (problem)
		debug("Kerberos v5 TGT passing failed: %s",
		    krb5_get_err_text(authctxt->krb5_ctx, problem));
	if (ccache)
		krb5_cc_destroy(authctxt->krb5_ctx, ccache);

	restore_uid();

	return (0);
}

int
auth_krb5_password(Authctxt *authctxt, const char *password)
{
#ifndef HEIMDAL
	krb5_creds creds;
	krb5_principal server;
	char ccname[40];
	int tmpfd;
#endif	
	krb5_error_code problem;

	if (authctxt->pw == NULL)
		return (0);

	temporarily_use_uid(authctxt->pw);

	problem = krb5_init(authctxt);
	if (problem)
		goto out;

	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
		    &authctxt->krb5_user);
	if (problem)
		goto out;

#ifdef HEIMDAL
	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops,
	    &authctxt->krb5_fwd_ccache);
	if (problem)
		goto out;

	problem = krb5_cc_initialize(authctxt->krb5_ctx,
	    authctxt->krb5_fwd_ccache, authctxt->krb5_user);
	if (problem)
		goto out;

	restore_uid();
	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
	    authctxt->krb5_fwd_ccache, password, 1, NULL);
	temporarily_use_uid(authctxt->pw);

	if (problem)
		goto out;

#else
	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
	    authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
	if (problem)
		goto out;

	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	    KRB5_NT_SRV_HST, &server);
	if (problem)
		goto out;

	restore_uid();
	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
	    NULL, NULL, NULL);
	krb5_free_principal(authctxt->krb5_ctx, server);
	temporarily_use_uid(authctxt->pw);
	if (problem)
		goto out;
	
	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, 
			  authctxt->pw->pw_name)) {
		problem = -1;
		goto out;
	} 

	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	
	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
		log("mkstemp(): %.100s", strerror(errno));
		problem = errno;
		goto out;
	}
	
	if (fchmod(tmpfd,S_IRUSR | S_IWUSR) == -1) {
		log("fchmod(): %.100s", strerror(errno));
		close(tmpfd);
		problem = errno;
		goto out;
	}
	close(tmpfd);

	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
	if (problem)
		goto out;

	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
				     authctxt->krb5_user);
	if (problem)
		goto out;
				
	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
				 &creds);
	if (problem)
		goto out;
#endif		

	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);

 out:
	restore_uid();

	if (problem) {
		if (authctxt->krb5_ctx != NULL && problem!=-1)
			debug("Kerberos password authentication failed: %s",
			    krb5_get_err_text(authctxt->krb5_ctx, problem));
		else
			debug("Kerberos password authentication failed: %d",
			    problem);

		krb5_cleanup_proc(authctxt);

		if (options.kerberos_or_local_passwd)
			return (-1);
		else
			return (0);
	}
	return (1);
}

void
krb5_cleanup_proc(void *context)
{
	Authctxt *authctxt = (Authctxt *)context;

	debug("krb5_cleanup_proc called");
	if (authctxt->krb5_fwd_ccache) {
		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
		authctxt->krb5_fwd_ccache = NULL;
	}
	if (authctxt->krb5_user) {
		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
		authctxt->krb5_user = NULL;
	}
	if (authctxt->krb5_auth_ctx) {
		krb5_auth_con_free(authctxt->krb5_ctx,
		    authctxt->krb5_auth_ctx);
		authctxt->krb5_auth_ctx = NULL;
	}
	if (authctxt->krb5_ctx) {
		krb5_free_context(authctxt->krb5_ctx);
		authctxt->krb5_ctx = NULL;
	}
}

#endif /* KRB5 */
Commit	Line	Data
aa9f6a6e	1	/*
aa9f6a6e	2	* Kerberos v5 authentication and ticket-passing routines.
762715ce	3	*
aa9f6a6e	4	* $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
aa9f6a6e	5	*/
bb15f28b	6	/*
	7	* Copyright (c) 2002 Daniel Kouril. All rights reserved.
	8	*
	9	* Redistribution and use in source and binary forms, with or without
	10	* modification, are permitted provided that the following conditions
	11	* are met:
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in the
	16	* documentation and/or other materials provided with the distribution.
	17	*
	18	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	19	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	20	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	21	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	22	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	23	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	24	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	25	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	26	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	27	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	28	*/
aa9f6a6e	29
aa9f6a6e	30	#include "includes.h"
b77a87e5	31	RCSID("$OpenBSD: auth-krb5.c,v 1.10 2002/11/21 23:03:51 deraadt Exp $");
93c3b6de	32
aa9f6a6e	33	#include "ssh.h"
	34	#include "ssh1.h"
	35	#include "packet.h"
	36	#include "xmalloc.h"
	37	#include "log.h"
	38	#include "servconf.h"
	39	#include "uidswap.h"
	40	#include "auth.h"
	41
	42	#ifdef KRB5
	43	#include <krb5.h>
12928e80	44	#ifndef HEIMDAL
	45	#define krb5_get_err_text(context,code) error_message(code)
	46	#endif /* !HEIMDAL */
aa9f6a6e	47
	48	extern ServerOptions options;
	49
	50	static int
	51	krb5_init(void *context)
	52	{
	53	Authctxt authctxt = (Authctxt )context;
	54	krb5_error_code problem;
	55	static int cleanup_registered = 0;
a0105740	56
aa9f6a6e	57	if (authctxt->krb5_ctx == NULL) {
	58	problem = krb5_init_context(&authctxt->krb5_ctx);
	59	if (problem)
	60	return (problem);
	61	krb5_init_ets(authctxt->krb5_ctx);
	62	}
	63	if (!cleanup_registered) {
	64	fatal_add_cleanup(krb5_cleanup_proc, authctxt);
	65	cleanup_registered = 1;
	66	}
	67	return (0);
	68	}
	69
	70	/*
	71	* Try krb5 authentication. server_user is passed for logging purposes
	72	* only, in auth is received ticket, in client is returned principal
	73	* from the ticket
	74	*/
a0105740	75	int
696f6bef	76	auth_krb5(Authctxt authctxt, krb5_data auth, char *client, krb5_data reply)
aa9f6a6e	77	{
	78	krb5_error_code problem;
	79	krb5_principal server;
aa9f6a6e	80	krb5_ticket *ticket;
ede8cea6	81	int fd, ret;
	82
	83	ret = 0;
aa9f6a6e	84	server = NULL;
aa9f6a6e	85	ticket = NULL;
696f6bef	86	reply->length = 0;
a0105740	87
aa9f6a6e	88	problem = krb5_init(authctxt);
a0105740	89	if (problem)
aa9f6a6e	90	goto err;
a0105740	91
aa9f6a6e	92	problem = krb5_auth_con_init(authctxt->krb5_ctx,
	93	&authctxt->krb5_auth_ctx);
	94	if (problem)
	95	goto err;
a0105740	96
aa9f6a6e	97	fd = packet_get_connection_in();
12928e80	98	#ifdef HEIMDAL
aa9f6a6e	99	problem = krb5_auth_con_setaddrs_from_fd(authctxt->krb5_ctx,
aa9f6a6e	100	authctxt->krb5_auth_ctx, &fd);
12928e80	101	#else
	102	problem = krb5_auth_con_genaddrs(authctxt->krb5_ctx,
	103	authctxt->krb5_auth_ctx,fd,
	104	KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR \|
	105	KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR);
	106	#endif
aa9f6a6e	107	if (problem)
aa9f6a6e	108	goto err;
a0105740	109
b77a87e5	110	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
aa9f6a6e	111	KRB5_NT_SRV_HST, &server);
	112	if (problem)
	113	goto err;
a0105740	114
aa9f6a6e	115	problem = krb5_rd_req(authctxt->krb5_ctx, &authctxt->krb5_auth_ctx,
	116	auth, server, NULL, NULL, &ticket);
	117	if (problem)
	118	goto err;
a0105740	119
12928e80	120	#ifdef HEIMDAL
aa9f6a6e	121	problem = krb5_copy_principal(authctxt->krb5_ctx, ticket->client,
aa9f6a6e	122	&authctxt->krb5_user);
12928e80	123	#else
	124	problem = krb5_copy_principal(authctxt->krb5_ctx,
	125	ticket->enc_part2->client,
	126	&authctxt->krb5_user);
	127	#endif
aa9f6a6e	128	if (problem)
aa9f6a6e	129	goto err;
a0105740	130
aa9f6a6e	131	/* if client wants mutual auth */
aa9f6a6e	132	problem = krb5_mk_rep(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
696f6bef	133	reply);
aa9f6a6e	134	if (problem)
aa9f6a6e	135	goto err;
a0105740	136
aa9f6a6e	137	/* Check .k5login authorization now. */
	138	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	139	authctxt->pw->pw_name))
	140	goto err;
a0105740	141
aa9f6a6e	142	if (client)
	143	krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	144	client);
a0105740	145
ede8cea6	146	ret = 1;
aa9f6a6e	147	err:
	148	if (server)
	149	krb5_free_principal(authctxt->krb5_ctx, server);
	150	if (ticket)
	151	krb5_free_ticket(authctxt->krb5_ctx, ticket);
696f6bef	152	if (!ret && reply->length) {
	153	xfree(reply->data);
	154	memset(reply, 0, sizeof(*reply));
	155	}
a0105740	156
c12337d9	157	if (problem) {
	158	if (authctxt->krb5_ctx != NULL)
	159	debug("Kerberos v5 authentication failed: %s",
	160	krb5_get_err_text(authctxt->krb5_ctx, problem));
	161	else
	162	debug("Kerberos v5 authentication failed: %d",
	163	problem);
	164	}
ede8cea6	165
ede8cea6	166	return (ret);
aa9f6a6e	167	}
	168
	169	int
	170	auth_krb5_tgt(Authctxt authctxt, krb5_data tgt)
	171	{
	172	krb5_error_code problem;
	173	krb5_ccache ccache = NULL;
	174	char *pname;
12928e80	175	krb5_creds **creds;
a0105740	176
aa9f6a6e	177	if (authctxt->pw == NULL \|\| authctxt->krb5_user == NULL)
aa9f6a6e	178	return (0);
a0105740	179
aa9f6a6e	180	temporarily_use_uid(authctxt->pw);
a0105740	181
12928e80	182	#ifdef HEIMDAL
aa9f6a6e	183	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_fcc_ops, &ccache);
12928e80	184	#else
	185	{
	186	char ccname[40];
	187	int tmpfd;
	188
	189	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	190
	191	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
	192	log("mkstemp(): %.100s", strerror(errno));
	193	problem = errno;
	194	goto fail;
	195	}
	196	if (fchmod(tmpfd,S_IRUSR \| S_IWUSR) == -1) {
	197	log("fchmod(): %.100s", strerror(errno));
	198	close(tmpfd);
	199	problem = errno;
	200	goto fail;
	201	}
	202	close(tmpfd);
	203	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &ccache);
	204	}
	205	#endif
aa9f6a6e	206	if (problem)
aa9f6a6e	207	goto fail;
a0105740	208
aa9f6a6e	209	problem = krb5_cc_initialize(authctxt->krb5_ctx, ccache,
	210	authctxt->krb5_user);
	211	if (problem)
	212	goto fail;
a0105740	213
12928e80	214	#ifdef HEIMDAL
aa9f6a6e	215	problem = krb5_rd_cred2(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	216	ccache, tgt);
	217	if (problem)
	218	goto fail;
12928e80	219	#else
	220	problem = krb5_rd_cred(authctxt->krb5_ctx, authctxt->krb5_auth_ctx,
	221	tgt, &creds, NULL);
	222	if (problem)
	223	goto fail;
	224	problem = krb5_cc_store_cred(authctxt->krb5_ctx, ccache, *creds);
	225	if (problem)
	226	goto fail;
	227	#endif
a0105740	228
aa9f6a6e	229	authctxt->krb5_fwd_ccache = ccache;
aa9f6a6e	230	ccache = NULL;
a0105740	231
aa9f6a6e	232	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
a0105740	233
aa9f6a6e	234	problem = krb5_unparse_name(authctxt->krb5_ctx, authctxt->krb5_user,
	235	&pname);
	236	if (problem)
	237	goto fail;
a0105740	238
aa9f6a6e	239	debug("Kerberos v5 TGT accepted (%s)", pname);
a0105740	240
aa9f6a6e	241	restore_uid();
a0105740	242
aa9f6a6e	243	return (1);
a0105740	244
aa9f6a6e	245	fail:
	246	if (problem)
	247	debug("Kerberos v5 TGT passing failed: %s",
	248	krb5_get_err_text(authctxt->krb5_ctx, problem));
	249	if (ccache)
	250	krb5_cc_destroy(authctxt->krb5_ctx, ccache);
a0105740	251
aa9f6a6e	252	restore_uid();
a0105740	253
aa9f6a6e	254	return (0);
	255	}
	256
	257	int
	258	auth_krb5_password(Authctxt authctxt, const char password)
	259	{
12928e80	260	#ifndef HEIMDAL
	261	krb5_creds creds;
	262	krb5_principal server;
	263	char ccname[40];
	264	int tmpfd;
	265	#endif
aa9f6a6e	266	krb5_error_code problem;
a0105740	267
aa9f6a6e	268	if (authctxt->pw == NULL)
aa9f6a6e	269	return (0);
a0105740	270
aa9f6a6e	271	temporarily_use_uid(authctxt->pw);
a0105740	272
aa9f6a6e	273	problem = krb5_init(authctxt);
	274	if (problem)
	275	goto out;
a0105740	276
aa9f6a6e	277	problem = krb5_parse_name(authctxt->krb5_ctx, authctxt->pw->pw_name,
	278	&authctxt->krb5_user);
	279	if (problem)
	280	goto out;
a0105740	281
12928e80	282	#ifdef HEIMDAL
aa9f6a6e	283	problem = krb5_cc_gen_new(authctxt->krb5_ctx, &krb5_mcc_ops,
	284	&authctxt->krb5_fwd_ccache);
	285	if (problem)
	286	goto out;
a0105740	287
aa9f6a6e	288	problem = krb5_cc_initialize(authctxt->krb5_ctx,
	289	authctxt->krb5_fwd_ccache, authctxt->krb5_user);
	290	if (problem)
	291	goto out;
a0105740	292
a0105740	293	restore_uid();
aa9f6a6e	294	problem = krb5_verify_user(authctxt->krb5_ctx, authctxt->krb5_user,
aa9f6a6e	295	authctxt->krb5_fwd_ccache, password, 1, NULL);
a0105740	296	temporarily_use_uid(authctxt->pw);
a0105740	297
aa9f6a6e	298	if (problem)
aa9f6a6e	299	goto out;
a0105740	300
12928e80	301	#else
	302	problem = krb5_get_init_creds_password(authctxt->krb5_ctx, &creds,
	303	authctxt->krb5_user, (char *)password, NULL, NULL, 0, NULL, NULL);
	304	if (problem)
	305	goto out;
	306
	307	problem = krb5_sname_to_principal(authctxt->krb5_ctx, NULL, NULL,
	308	KRB5_NT_SRV_HST, &server);
	309	if (problem)
	310	goto out;
	311
	312	restore_uid();
	313	problem = krb5_verify_init_creds(authctxt->krb5_ctx, &creds, server,
	314	NULL, NULL, NULL);
	315	krb5_free_principal(authctxt->krb5_ctx, server);
	316	temporarily_use_uid(authctxt->pw);
	317	if (problem)
	318	goto out;
	319
	320	if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
	321	authctxt->pw->pw_name)) {
875ec275	322	problem = -1;
12928e80	323	goto out;
	324	}
	325
	326	snprintf(ccname,sizeof(ccname),"FILE:/tmp/krb5cc_%d_XXXXXX",geteuid());
	327
	328	if ((tmpfd = mkstemp(ccname+strlen("FILE:")))==-1) {
	329	log("mkstemp(): %.100s", strerror(errno));
	330	problem = errno;
	331	goto out;
	332	}
	333
	334	if (fchmod(tmpfd,S_IRUSR \| S_IWUSR) == -1) {
	335	log("fchmod(): %.100s", strerror(errno));
	336	close(tmpfd);
	337	problem = errno;
	338	goto out;
	339	}
	340	close(tmpfd);
	341
	342	problem = krb5_cc_resolve(authctxt->krb5_ctx, ccname, &authctxt->krb5_fwd_ccache);
	343	if (problem)
	344	goto out;
	345
	346	problem = krb5_cc_initialize(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
	347	authctxt->krb5_user);
	348	if (problem)
	349	goto out;
	350
	351	problem= krb5_cc_store_cred(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache,
	352	&creds);
	353	if (problem)
	354	goto out;
	355	#endif
	356
aa9f6a6e	357	authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
a0105740	358
aa9f6a6e	359	out:
aa9f6a6e	360	restore_uid();
a0105740	361
aa9f6a6e	362	if (problem) {
12928e80	363	if (authctxt->krb5_ctx != NULL && problem!=-1)
c12337d9	364	debug("Kerberos password authentication failed: %s",
	365	krb5_get_err_text(authctxt->krb5_ctx, problem));
	366	else
	367	debug("Kerberos password authentication failed: %d",
	368	problem);
a0105740	369
aa9f6a6e	370	krb5_cleanup_proc(authctxt);
a0105740	371
aa9f6a6e	372	if (options.kerberos_or_local_passwd)
	373	return (-1);
	374	else
	375	return (0);
	376	}
	377	return (1);
	378	}
	379
	380	void
	381	krb5_cleanup_proc(void *context)
	382	{
	383	Authctxt authctxt = (Authctxt )context;
a0105740	384
aa9f6a6e	385	debug("krb5_cleanup_proc called");
	386	if (authctxt->krb5_fwd_ccache) {
	387	krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
	388	authctxt->krb5_fwd_ccache = NULL;
	389	}
	390	if (authctxt->krb5_user) {
	391	krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
	392	authctxt->krb5_user = NULL;
	393	}
	394	if (authctxt->krb5_auth_ctx) {
	395	krb5_auth_con_free(authctxt->krb5_ctx,
	396	authctxt->krb5_auth_ctx);
	397	authctxt->krb5_auth_ctx = NULL;
	398	}
	399	if (authctxt->krb5_ctx) {
	400	krb5_free_context(authctxt->krb5_ctx);
	401	authctxt->krb5_ctx = NULL;
	402	}
	403	}
	404
	405	#endif /* KRB5 */