krb5_child.c revision 047332ebbe8397a70c92e5e3a5fbd40a9d00d0b5
/*
SSSD
Kerberos 5 Backend Module -- tgt_req and changepw child
Authors:
Sumit Bose <sbose@redhat.com>
Copyright (C) 2009-2010 Red Hat
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <unistd.h>
#include <popt.h>
#include <security/pam_modules.h>
#include "util/user_info_msg.h"
#include "providers/child_common.h"
#include "providers/dp_backend.h"
#include "providers/krb5/krb5_auth.h"
#include "providers/krb5/krb5_utils.h"
#define SSSD_KRB5_CHANGEPW_PRINCIPAL "kadmin/changepw"
struct krb5_child_ctx {
/* opts taken from kinit */
/* in seconds */
int forwardable;
int proxiable;
int addresses;
int not_forwardable;
int not_proxiable;
int no_addresses;
int verbose;
char* principal_name;
char* service_name;
char* keytab_name;
char* k5_cache_name;
char* k4_cache_name;
char *kdcip;
char *realm;
char *ccache_dir;
char *ccname_template;
int auth_timeout;
int child_debug_fd;
};
struct krb5_req {
char* name;
int read_from_child_fd;
int write_to_child_fd;
struct krb5_child_ctx *krb5_ctx;
char *ccname;
char *keytab;
bool validate;
const char *upn;
};
static krb5_context krb5_error_ctx;
static const char *__krb5_error_msg;
} while(0);
{
int ret;
long exp_time;
if (password_expiration == 0) {
return;
}
return;
}
return;
}
}
return;
}
{
int ret;
if (num_prompts != 0) {
return KRB5_LIBOS_CANTREADPWD;
}
return EOK;
}
}
return EOK;
}
{
return ENOMEM;
}
if (kerr != 0) {
goto done;
}
if (kerr != 0) {
goto done;
}
done:
if (kerr != 0) {
}
} else {
}
return kerr;
}
{
char *cc_file_name;
int fd = -1;
char *dummy;
char *tmp_ccname;
} else {
}
if (cc_file_name[0] != '/') {
return EINVAL;
}
if (tmp_ccname == NULL) {
return ENOMEM;
}
if (fd == -1) {
return errno;
}
if (kerr != 0) {
goto done;
}
if (kerr != 0) {
goto done;
}
if (fd != -1) {
fd = -1;
}
if (kerr != 0) {
goto done;
}
} else {
}
if (kerr != 0) {
goto done;
}
if (kerr != 0) {
goto done;
}
if (fd == -1) {
goto done;
}
}
if (kerr == -1) {
}
done:
if (fd != -1) {
}
}
return kerr;
}
{
size_t p = 0;
struct response_data *pdr;
/* A buffer with the following structure must be created:
* int32_t status of the request (required)
* message (zero or more)
*
* A message consists of:
* int32_t type of the message
* int32_t length of the following data
* uint8_t[len] data
*/
}
return ENOMEM;
}
}
return EOK;
}
int pam_status)
{
int ret;
return NULL;
}
if (kerr == 0) {
} else {
return NULL;
}
return NULL;
}
}
} else {
return NULL;
}
}
}
return NULL;
}
return resp;
}
{
int ret;
return ENOMEM;
}
written = 0;
if (ret == -1) {
continue;
}
return ret;
}
}
return EOK;
}
{
if (kerr != 0) {
return kerr;
}
if (kerr != 0) {
return kerr;
}
/* We look for the first entry from our realm or take the last one */
break;
}
if (kerr != 0) {
}
}
/* Close the keytab here. Even though we're using cursors, the file
* handle is stored in the krb5_keytab structure, and it gets
* overwritten when the verify_init_creds() call below creates its own
* cursor, creating a leak. */
if (kerr != 0) {
goto done;
}
/* check if we got any errors from krb5_kt_next_entry */
goto done;
}
/* Get the principal to which the key belongs, for logging purposes. */
if (kerr != 0) {
"not verifying TGT.\n"));
goto done;
}
if (kerr == 0) {
} else {
}
done:
}
}
}
return kerr;
}
char *password)
{
krb5_error_code kerr = 0;
int ret;
kr);
if (kerr != 0) {
}
if (kerr != 0) {
return kerr;
}
if (kerr != 0) {
return kerr;
}
/* We drop root privileges which were needed to read the keytab file
* for the validation validation of the credentials here to run the
* ccache I/O operations with user privileges. */
return ret;
}
} else {
}
if (kerr != 0) {
goto done;
}
kerr = 0;
done:
return kerr;
}
{
int ret;
krb5_error_code kerr = 0;
char *newpass_str = NULL;
int pam_status = PAM_SYSTEM_ERR;
int result_code = -1;
char *user_error_message = NULL;
char *changepw_princ = NULL;
goto sendresponse;
}
if (changepw_princ == NULL) {
goto sendresponse;
}
/* We do not need a password expiration warning here. */
}
if (kerr != 0) {
if (kerr == KRB5_KDC_UNREACH) {
}
goto sendresponse;
}
"successfull.\n"));
goto sendresponse;
}
if (newpass_str == NULL) {
goto sendresponse;
}
if (kerr == KRB5_KDC_UNREACH) {
goto sendresponse;
}
if (kerr != 0 || result_code != 0) {
if (kerr != 0) {
} else {
}
if (result_code_string.length > 0) {
if (user_error_message == NULL) {
}
}
if (result_string.length > 0) {
if (user_error_message == NULL) {
}
}
if (user_error_message != NULL) {
&user_resp_len, &user_resp);
} else {
}
}
}
goto sendresponse;
}
if (kerr != 0) {
if (kerr == KRB5_KDC_UNREACH) {
}
}
}
return ret;
}
{
int ret;
krb5_error_code kerr = 0;
char *changepw_princ = NULL;
int pam_status = PAM_SYSTEM_ERR;
goto sendresponse;
}
if (changepw_princ == NULL) {
goto sendresponse;
}
/* If the password is expired the KDC will always return
KRB5KDC_ERR_KEY_EXP regardless if the supplied password is correct or
not. In general the password can still be used to get a changepw ticket.
So we validate the password by trying to get a changepw ticket. */
if (kerr == KRB5KDC_ERR_KEY_EXP) {
if (kerr != 0) {
}
if (kerr == 0) {
}
}
if (kerr != 0) {
switch (kerr) {
case KRB5_KDC_UNREACH:
break;
case KRB5KDC_ERR_KEY_EXP:
break;
break;
default:
}
}
}
return ret;
}
{
int ret;
int pam_status = PAM_SUCCESS;
if (ret != 0) {
}
}
return ret;
}
{
size_t p = 0;
p += len;
p += len;
p += len;
p += len;
p += len;
} else {
pd->newauthtok_size = 0;
}
return EOK;
}
static int krb5_cleanup(void *ptr)
{
}
}
}
return EOK;
}
{
krb5_error_code kerr = 0;
goto failed;
}
}
case SSS_PAM_AUTHENTICATE:
/* If we are offline, we need to create an empty ccache file */
if (offline) {
} else {
}
break;
case SSS_PAM_CHAUTHTOK:
case SSS_PAM_CHAUTHTOK_PRELIM:
break;
default:
goto failed;
}
if (kerr != 0) {
goto failed;
}
if (kerr != 0) {
goto failed;
}
if (kerr != 0) {
goto failed;
}
goto failed;
}
if (kerr != 0) {
goto failed;
}
/* A prompter is used to catch messages about when a password will
* expired. The library shall not use the prompter to ask for a new password
* but shall return KRB5KDC_ERR_KEY_EXP. */
if (kerr != 0) {
goto failed;
}
/* TODO: set options, e.g.
* krb5_get_init_creds_opt_set_tkt_life
* krb5_get_init_creds_opt_set_renew_life
* krb5_get_init_creds_opt_set_forwardable
* krb5_get_init_creds_opt_set_proxiable
* krb5_get_init_creds_opt_set_etype_list
* krb5_get_init_creds_opt_set_address_list
* krb5_get_init_creds_opt_set_preauth_list
* krb5_get_init_creds_opt_set_salt
* krb5_get_init_creds_opt_set_change_password_prompt
* krb5_get_init_creds_opt_set_pa
*/
return EOK;
return kerr;
}
{
int ret;
int opt;
int debug_fd = -1;
struct poptOption long_options[] = {
_("Debug level"), NULL},
_("Add debug timestamps"), NULL},
_("An open file descriptor for the debug logs"), NULL},
};
switch(opt) {
default:
_exit(-1);
}
}
_exit(-1);
}
if (debug_fd != -1) {
}
}
_exit(-1);
}
if (ret == -1) {
continue;
}
goto fail;
} else if (ret > 0) {
if (len > IN_BUF_SIZE) {
goto fail;
}
continue;
} else {
goto fail;
}
}
goto fail;
}
goto fail;
}
goto fail;
}
goto fail;
}
return 0;
fail:
exit(-1);
}