crypto/dist/heimdal/lib/krb5/sendauth.c

   1 /*
   2  * Copyright (c) 1997 - 2006 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  *
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * 3. Neither the name of the Institute nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "krb5_locl.h"
  35
  36 __RCSID("$Heimdal: sendauth.c 17442 2006-05-05 09:31:15Z lha $"
  37         "$NetBSD$");
  38
  39 /*
  40  * The format seems to be:
  41  * client -> server
  42  *
  43  * 4 bytes - length
  44  * KRB5_SENDAUTH_V1.0 (including zero)
  45  * 4 bytes - length
  46  * protocol string (with terminating zero)
  47  *
  48  * server -> client
  49  * 1 byte - (0 = OK, else some kind of error)
  50  *
  51  * client -> server
  52  * 4 bytes - length
  53  * AP-REQ
  54  *
  55  * server -> client
  56  * 4 bytes - length (0 = OK, else length of error)
  57  * (error)
  58  *
  59  * if(mutual) {
  60  * server -> client
  61  * 4 bytes - length
  62  * AP-REP
  63  * }
  64  */
  65
  66 krb5_error_code KRB5_LIB_FUNCTION
  67 krb5_sendauth(krb5_context context,
  68               krb5_auth_context *auth_context,
  69               krb5_pointer p_fd,
  70               const char *appl_version,
  71               krb5_principal client,
  72               krb5_principal server,
  73               krb5_flags ap_req_options,
  74               krb5_data *in_data,
  75               krb5_creds *in_creds,
  76               krb5_ccache ccache,
  77               krb5_error **ret_error,
  78               krb5_ap_rep_enc_part **rep_result,
  79               krb5_creds **out_creds)
  80 {
  81     krb5_error_code ret;
  82     uint32_t len, net_len;
  83     const char *version = KRB5_SENDAUTH_VERSION;
  84     u_char repl;
  85     krb5_data ap_req, error_data;
  86     krb5_creds this_cred;
  87     krb5_principal this_client = NULL;
  88     krb5_creds *creds;
  89     ssize_t sret;
  90     krb5_boolean my_ccache = FALSE;
  91
  92     len = strlen(version) + 1;
  93     net_len = htonl(len);
  94     if (krb5_net_write (context, p_fd, &net_len, 4) != 4
  95         || krb5_net_write (context, p_fd, version, len) != len) {
  96         ret = errno;
  97         krb5_set_error_string (context, "write: %s", strerror(ret));
  98         return ret;
  99     }
 100
 101     len = strlen(appl_version) + 1;
 102     net_len = htonl(len);
 103     if (krb5_net_write (context, p_fd, &net_len, 4) != 4
 104         || krb5_net_write (context, p_fd, appl_version, len) != len) {
 105         ret = errno;
 106         krb5_set_error_string (context, "write: %s", strerror(ret));
 107         return ret;
 108     }
 109
 110     sret = krb5_net_read (context, p_fd, &repl, sizeof(repl));
 111     if (sret < 0) {
 112         ret = errno;
 113         krb5_set_error_string (context, "read: %s", strerror(ret));
 114         return ret;
 115     } else if (sret != sizeof(repl)) {
 116         krb5_clear_error_string (context);
 117         return KRB5_SENDAUTH_BADRESPONSE;
 118     }
 119
 120     if (repl != 0) {
 121         krb5_clear_error_string (context);
 122         return KRB5_SENDAUTH_REJECTED;
 123     }
 124
 125     if (in_creds == NULL) {
 126         if (ccache == NULL) {
 127             ret = krb5_cc_default (context, &ccache);
 128             if (ret)
 129                 return ret;
 130             my_ccache = TRUE;
 131         }
 132
 133         if (client == NULL) {
 134             ret = krb5_cc_get_principal (context, ccache, &this_client);
 135             if (ret) {
 136                 if(my_ccache)
 137                     krb5_cc_close(context, ccache);
 138                 return ret;
 139             }
 140             client = this_client;
 141         }
 142         memset(&this_cred, 0, sizeof(this_cred));
 143         this_cred.client = client;
 144         this_cred.server = server;
 145         this_cred.times.endtime = 0;
 146         this_cred.ticket.length = 0;
 147         in_creds = &this_cred;
 148     }
 149     if (in_creds->ticket.length == 0) {
 150         ret = krb5_get_credentials (context, 0, ccache, in_creds, &creds);
 151         if (ret) {
 152             if(my_ccache)
 153                 krb5_cc_close(context, ccache);
 154             return ret;
 155         }
 156     } else {
 157         creds = in_creds;
 158     }
 159     if(my_ccache)
 160         krb5_cc_close(context, ccache);
 161     ret = krb5_mk_req_extended (context,
 162                                 auth_context,
 163                                 ap_req_options,
 164                                 in_data,
 165                                 creds,
 166                                 &ap_req);
 167
 168     if (out_creds)
 169         *out_creds = creds;
 170     else
 171         krb5_free_creds(context, creds);
 172     if(this_client)
 173         krb5_free_principal(context, this_client);
 174
 175     if (ret)
 176         return ret;
 177
 178     ret = krb5_write_message (context,
 179                               p_fd,
 180                               &ap_req);
 181     if (ret)
 182         return ret;
 183
 184     krb5_data_free (&ap_req);
 185
 186     ret = krb5_read_message (context, p_fd, &error_data);
 187     if (ret)
 188         return ret;
 189
 190     if (error_data.length != 0) {
 191         KRB_ERROR error;
 192
 193         ret = krb5_rd_error (context, &error_data, &error);
 194         krb5_data_free (&error_data);
 195         if (ret == 0) {
 196             ret = krb5_error_from_rd_error(context, &error, NULL);
 197             if (ret_error != NULL) {
 198                 *ret_error = malloc (sizeof(krb5_error));
 199                 if (*ret_error == NULL) {
 200                     krb5_free_error_contents (context, &error);
 201                 } else {
 202                     **ret_error = error;
 203                 }
 204             } else {
 205                 krb5_free_error_contents (context, &error);
 206             }
 207             return ret;
 208         } else {
 209             krb5_clear_error_string(context);
 210             return ret;
 211         }
 212     }
 213
 214     if (ap_req_options & AP_OPTS_MUTUAL_REQUIRED) {
 215         krb5_data ap_rep;
 216         krb5_ap_rep_enc_part *ignore;
 217
 218         krb5_data_zero (&ap_rep);
 219         ret = krb5_read_message (context,
 220                                  p_fd,
 221                                  &ap_rep);
 222         if (ret)
 223             return ret;
 224
 225         ret = krb5_rd_rep (context, *auth_context, &ap_rep,
 226                            rep_result ? rep_result : &ignore);
 227         krb5_data_free (&ap_rep);
 228         if (ret)
 229             return ret;
 230         if (rep_result == NULL)
 231             krb5_free_ap_rep_enc_part (context, ignore);
 232     }
 233     return 0;
 234 }