auth-krb5.c revision 7c478bd95313f5f23a4c958a745db2134aa03244
/*
* Kerberos v5 authentication and ticket-passing routines.
*
* $FreeBSD: src/crypto/openssh/auth-krb5.c,v 1.6 2001/02/13 16:58:04 assar Exp $
*/
/*
* Copyright (c) 2002 Daniel Kouril. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "includes.h"
RCSID("$OpenBSD: auth-krb5.c,v 1.9 2002/09/09 06:48:06 itojun Exp $");
#pragma ident "%Z%%M% %I% %E% SMI"
#include "ssh.h"
#include "ssh1.h"
#include "packet.h"
#include "xmalloc.h"
#include "log.h"
#include "servconf.h"
#include "uidswap.h"
#include "auth.h"
#ifdef KRB5
#include <krb5.h>
#ifndef HEIMDAL
#endif /* !HEIMDAL */
extern ServerOptions options;
static int
{
static int cleanup_registered = 0;
if (problem)
return (problem);
}
if (!cleanup_registered) {
cleanup_registered = 1;
}
return (0);
}
/*
* Try krb5 authentication. server_user is passed for logging purposes
* only, in auth is received ticket, in client is returned principal
* from the ticket
*/
int
{
ret = 0;
if (problem)
goto err;
if (problem)
goto err;
#ifdef HEIMDAL
#else
#endif
if (problem)
goto err;
if (problem)
goto err;
if (problem)
goto err;
#ifdef HEIMDAL
#else
#endif
if (problem)
goto err;
/* if client wants mutual auth */
reply);
if (problem)
goto err;
/* Check .k5login authorization now. */
goto err;
if (client)
client);
ret = 1;
err:
if (server)
if (ticket)
}
if (problem) {
debug("Kerberos v5 authentication failed: %s",
else
debug("Kerberos v5 authentication failed: %d",
problem);
}
return (ret);
}
int
{
char *pname;
krb5_creds **creds;
return (0);
#ifdef HEIMDAL
#else
{
char ccname[40];
int tmpfd;
goto fail;
}
goto fail;
}
}
#endif
if (problem)
goto fail;
if (problem)
goto fail;
#ifdef HEIMDAL
if (problem)
goto fail;
#else
if (problem)
goto fail;
if (problem)
goto fail;
#endif
authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
&pname);
if (problem)
goto fail;
restore_uid();
return (1);
fail:
if (problem)
debug("Kerberos v5 TGT passing failed: %s",
if (ccache)
restore_uid();
return (0);
}
int
{
#ifndef HEIMDAL
char ccname[40];
int tmpfd;
#endif
return (0);
if (problem)
goto out;
if (problem)
goto out;
#ifdef HEIMDAL
if (problem)
goto out;
if (problem)
goto out;
restore_uid();
if (problem)
goto out;
#else
if (problem)
goto out;
if (problem)
goto out;
restore_uid();
if (problem)
goto out;
problem = -1;
goto out;
}
goto out;
}
goto out;
}
if (problem)
goto out;
if (problem)
goto out;
&creds);
if (problem)
goto out;
#endif
authctxt->krb5_ticket_file = (char *)krb5_cc_get_name(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
out:
restore_uid();
if (problem) {
debug("Kerberos password authentication failed: %s",
else
debug("Kerberos password authentication failed: %d",
problem);
return (-1);
else
return (0);
}
return (1);
}
void
krb5_cleanup_proc(void *context)
{
debug("krb5_cleanup_proc called");
if (authctxt->krb5_fwd_ccache) {
}
}
if (authctxt->krb5_auth_ctx) {
}
}
}
#endif /* KRB5 */