usr.bin/passwd/krb5_passwd.c

   1 /* $NetBSD: krb5_passwd.c,v 1.20 2012/04/22 23:43:51 christos Exp $ */
   2
   3 /*
   4  * Copyright (c) 2000, 2005 The NetBSD Foundation, Inc.
   5  * All rights reserved.
   6  *
   7  * This code is derived from software contributed to The NetBSD Foundation
   8  * by Johan Danielsson; and by Jason R. Thorpe.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  *
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
  24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  30  * POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 /* uses the `Kerberos Change Password Protocol' */
  34
  35 #include <stdio.h>
  36 #include <stdlib.h>
  37 #include <string.h>
  38 #include <err.h>
  39 #include <errno.h>
  40 #include <pwd.h>
  41 #include <unistd.h>
  42
  43 #include <openssl/ui.h>
  44 #include <krb5.h>
  45
  46 #include "extern.h"
  47
  48 static void
  49 pwkrb5_warn(const char *msg, krb5_context context, krb5_error_code ret)
  50 {
  51     const char *errtxt = krb5_get_error_message(context, ret);
  52     if (errtxt != NULL) {
  53             warnx("%s: %s", msg, errtxt);
  54             krb5_free_error_message(context, errtxt);
  55     } else
  56             warnx("%s: %d", msg, ret);
  57 }
  58
  59 #ifdef USE_PAM
  60
  61 void
  62 pwkrb5_usage(const char *prefix)
  63 {
  64
  65         (void) fprintf(stderr, "%s %s [-d krb5 | -k] [principal]\n",
  66             prefix, getprogname());
  67 }
  68
  69 void
  70 pwkrb5_argv0_usage(const char *prefix)
  71 {
  72
  73         (void) fprintf(stderr, "%s %s [principal]\n",
  74             prefix, getprogname());
  75 }
  76
  77 void
  78 pwkrb5_process(const char *username, int argc, char **argv)
  79 {
  80         krb5_context context;
  81         krb5_error_code ret;
  82         krb5_get_init_creds_opt *opt;
  83         krb5_principal principal;
  84         krb5_creds cred;
  85         int result_code;
  86         krb5_data result_code_string, result_string;
  87         char pwbuf[BUFSIZ];
  88         int ch;
  89
  90         while ((ch = getopt(argc, argv, "5ku:")) != -1) {
  91                 switch (ch) {
  92                 case '5':
  93                         /*
  94                          * Compatibility option that historically
  95                          * specified to use Kerberos 5.  Silently
  96                          * ignore it.
  97                          */
  98                         break;
  99
 100                 case 'k':
 101                         /*
 102                          * Absorb the -k that may have gotten us here.
 103                          */
 104                         break;
 105
 106                 case 'u':
 107                         /*
 108                          * Historical option to specify principal.
 109                          */
 110                         username = optarg;
 111                         break;
 112
 113                 default:
 114                         usage();
 115                         /* NOTREACHED */
 116                 }
 117         }
 118
 119         argc -= optind;
 120         argv += optind;
 121
 122         switch (argc) {
 123         case 0:
 124                 /* username already provided */
 125                 break;
 126         case 1:
 127                 /* overrides -u <principal> */
 128                 username = argv[0];
 129                 break;
 130         default:
 131                 usage();
 132                 /* NOTREACHED */
 133         }
 134
 135         ret = krb5_init_context(&context);
 136         if (ret != 0) {
 137                 if (ret == ENXIO)
 138                         errx(1, "Kerberos 5 not in use.");
 139                 errx(1, "Unable to initialize Kerberos 5: %s", strerror(ret));
 140         }
 141
 142         ret = krb5_get_init_creds_opt_alloc(context, &opt);
 143         if (ret) {
 144                 pwkrb5_warn("failed to allocate opts", context, ret);
 145                 goto bad;
 146         }
 147
 148         krb5_get_init_creds_opt_set_tkt_life(opt, 300L);
 149         krb5_get_init_creds_opt_set_forwardable(opt, FALSE);
 150         krb5_get_init_creds_opt_set_proxiable(opt, FALSE);
 151
 152         ret = krb5_parse_name(context, username, &principal);
 153         if (ret) {
 154                 krb5_get_init_creds_opt_free(context, opt);
 155                 pwkrb5_warn("failed to parse principal", context, ret);
 156                 goto bad;
 157         }
 158
 159         ret = krb5_get_init_creds_password(context,
 160                                            &cred,
 161                                            principal,
 162                                            NULL,
 163                                            krb5_prompter_posix,
 164                                            NULL,
 165                                            0L,
 166                                            "kadmin/changepw",
 167                                            opt);
 168
 169         krb5_get_init_creds_opt_free(context, opt);
 170         switch (ret) {
 171         case 0:
 172                 break;
 173
 174         case KRB5_LIBOS_PWDINTR :
 175                 /* XXX */
 176                 goto bad;
 177
 178         case KRB5KRB_AP_ERR_BAD_INTEGRITY :
 179         case KRB5KRB_AP_ERR_MODIFIED :
 180                 fprintf(stderr, "Password incorrect\n");
 181                 goto bad;
 182
 183         default:
 184                 pwkrb5_warn("failed to get credentials", context, ret);
 185                 goto bad;
 186         }
 187
 188         krb5_data_zero(&result_code_string);
 189         krb5_data_zero(&result_string);
 190
 191         /* XXX use getpass? It has a broken interface. */
 192         if (UI_UTIL_read_pw_string(pwbuf, sizeof(pwbuf),
 193                                    "New password: ", 1) != 0)
 194                 goto bad;
 195
 196         ret = krb5_set_password(context, &cred, pwbuf, NULL,
 197                                 &result_code,
 198                                 &result_code_string,
 199                                 &result_string);
 200         if (ret) {
 201                 pwkrb5_warn("unable to set password", context, ret);
 202                 goto bad;
 203         }
 204
 205         printf("%s%s%.*s\n",
 206             krb5_passwd_result_to_string(context, result_code),
 207             result_string.length > 0 ? " : " : "",
 208             (int)result_string.length,
 209             result_string.length > 0 ? (char *)result_string.data : "");
 210
 211         krb5_data_free(&result_code_string);
 212         krb5_data_free(&result_string);
 213
 214         krb5_free_cred_contents(context, &cred);
 215         krb5_free_context(context);
 216         if (result_code)
 217                 exit(1);
 218         return;
 219
 220  bad:
 221         krb5_free_context(context);
 222         exit(1);
 223 }
 224
 225 #else /* ! USE_PAM */
 226
 227 static krb5_context defcontext;
 228 static krb5_principal defprinc;
 229 static int kusage = PW_USE;
 230
 231 int
 232 krb5_init(const char *progname)
 233 {
 234     return krb5_init_context(&defcontext);
 235 }
 236
 237 int
 238 krb5_arg (char ch, const char *opt)
 239 {
 240     krb5_error_code ret;
 241     switch(ch) {
 242     case '5':
 243     case 'k':
 244         kusage = PW_USE_FORCE;
 245         return 1;
 246     case 'u':
 247         ret = krb5_parse_name(defcontext, opt, &defprinc);
 248         if(ret) {
 249             krb5_warn(defcontext, ret, "%s", opt);
 250             return 0;
 251         }
 252         return 1;
 253     }
 254     return 0;
 255 }
 256
 257 int
 258 krb5_arg_end(void)
 259 {
 260     return kusage;
 261 }
 262
 263 void
 264 krb5_end(void)
 265 {
 266     if (defcontext == NULL)
 267         return;
 268     if(defprinc)
 269         krb5_free_principal(defcontext, defprinc);
 270     krb5_free_context(defcontext);
 271 }
 272
 273 int
 274 krb5_chpw(const char *username)
 275 {
 276     krb5_error_code ret;
 277     krb5_context context;
 278     krb5_principal principal;
 279     krb5_get_init_creds_opt *opt;
 280     krb5_creds cred;
 281     int result_code;
 282     krb5_data result_code_string, result_string;
 283     char pwbuf[BUFSIZ];
 284
 285     ret = krb5_init_context (&context);
 286     if (ret) {
 287         pwkrb5_warn("failed kerberos initialisation", context, ret);
 288         return 1;
 289     }
 290
 291     ret = krb5_get_init_creds_opt_alloc (context, &opt);
 292     if (ret) {
 293         pwkrb5_warn("failed to allocate credential opt", context, ret);
 294         return 1;
 295     }
 296
 297     krb5_get_init_creds_opt_set_tkt_life (opt, 300);
 298     krb5_get_init_creds_opt_set_forwardable (opt, FALSE);
 299     krb5_get_init_creds_opt_set_proxiable (opt, FALSE);
 300
 301     if(username != NULL) {
 302         ret = krb5_parse_name (context, username, &principal);
 303         if (ret) {
 304             krb5_get_init_creds_opt_free (context, opt);
 305             pwkrb5_warn("failed to parse principal", context, ret);
 306             return 1;
 307         }
 308     } else
 309         principal = defprinc;
 310
 311     ret = krb5_get_init_creds_password (context,
 312                                         &cred,
 313                                         principal,
 314                                         NULL,
 315                                         krb5_prompter_posix,
 316                                         NULL,
 317                                         0,
 318                                         "kadmin/changepw",
 319                                         opt);
 320
 321     krb5_get_init_creds_opt_free (context, opt);
 322     switch (ret) {
 323     case 0:
 324         break;
 325     case KRB5_LIBOS_PWDINTR :
 326         /* XXX */
 327         return 1;
 328     case KRB5KRB_AP_ERR_BAD_INTEGRITY :
 329     case KRB5KRB_AP_ERR_MODIFIED :
 330         fprintf(stderr, "Password incorrect\n");
 331         return 1;
 332         break;
 333     default:
 334         pwkrb5_warn("failed to get credentials", context, ret);
 335         return 1;
 336     }
 337     krb5_data_zero (&result_code_string);
 338     krb5_data_zero (&result_string);
 339
 340     /* XXX use getpass? It has a broken interface. */
 341     if(UI_UTIL_read_pw_string(pwbuf, sizeof(pwbuf), "New password: ", 1) != 0)
 342         return 1;
 343
 344     ret = krb5_set_password (context, &cred, pwbuf, NULL,
 345                              &result_code,
 346                              &result_code_string,
 347                              &result_string);
 348     if (ret)
 349         krb5_err (context, 1, ret, "krb5_set_password");
 350
 351     printf ("%s%s%.*s\n", krb5_passwd_result_to_string(context, result_code),
 352             result_string.length > 0 ? " : " : "",
 353             (int)result_string.length,
 354             result_string.length > 0 ? (char *)result_string.data : "");
 355
 356     krb5_data_free (&result_code_string);
 357     krb5_data_free (&result_string);
 358
 359     krb5_free_cred_contents (context, &cred);
 360     krb5_free_context (context);
 361     return result_code;
 362 }
 363
 364 #endif /* USE_PAM */