2 * Copyright (c) 1991, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * Copyright (C) 1990 by the Massachusetts Institute of Technology
33 * Export of this software from the United States of America may
34 * require a specific license from the United States Government.
35 * It is the responsibility of any person or organization contemplating
36 * export to obtain such a license before exporting.
38 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
39 * distribute this software and its documentation for any purpose and
40 * without fee is hereby granted, provided that the above copyright
41 * notice appear in all copies and that both that copyright notice and
42 * this permission notice appear in supporting documentation, and that
43 * the name of M.I.T. not be used in advertising or publicity pertaining
44 * to distribution of the software without specific, written prior
45 * permission. M.I.T. makes no representations about the suitability of
46 * this software for any purpose. It is provided "as is" without express
47 * or implied warranty.
50 #include <sys/cdefs.h>
52 __FBSDID("$FreeBSD$");
56 #include <arpa/telnet.h>
64 #define Authenticator k5_Authenticator
72 int forward_flags = 0; /* Flags get set in telnet/main.c on -f and -F */
74 /* These values need to be the same as those defined in telnet/main.c. */
75 /* Either define them in both places, or put in some common header file. */
76 #define OPTS_FORWARD_CREDS 0x00000002
77 #define OPTS_FORWARDABLE_CREDS 0x00000001
79 void kerberos5_forward (Authenticator *);
81 static unsigned char str_data[1024] = { IAC, SB, TELOPT_AUTHENTICATION, 0,
82 AUTHTYPE_KERBEROS_V5, };
84 #define KRB_AUTH 0 /* Authentication data follows */
85 #define KRB_REJECT 1 /* Rejected (reason might follow) */
86 #define KRB_ACCEPT 2 /* Accepted */
87 #define KRB_RESPONSE 3 /* Response for mutual auth. */
89 #define KRB_FORWARD 4 /* Forwarded credentials follow */
90 #define KRB_FORWARD_ACCEPT 5 /* Forwarded credentials accepted */
91 #define KRB_FORWARD_REJECT 6 /* Forwarded credentials rejected */
93 static krb5_data auth;
94 static krb5_ticket *ticket;
96 static krb5_context context;
97 static krb5_auth_context auth_context;
100 print_krb5_error(krb5_context context, krb5_error_code code, const char *msg)
102 const char *error_message;
104 error_message = krb5_get_error_message(context, code);
105 printf(msg, error_message);
106 krb5_free_error_message(context, error_message);
110 Data(Authenticator *ap, int type, const char *d, int c)
112 unsigned char *p = str_data + 4;
113 const unsigned char *cd = d;
118 if (auth_debug_mode) {
119 printf("%s:%d: [%d] (%d)",
120 str_data[3] == TELQUAL_IS ? ">>>IS" : ">>>REPLY",
130 if ((*p++ = *cd++) == IAC)
135 if (str_data[3] == TELQUAL_IS)
136 printsub('>', &str_data[2], p - &str_data[2]);
137 return(net_write(str_data, p - str_data));
141 kerberos5_init(Authenticator *ap __unused, int server)
145 ret = krb5_init_context(&context);
150 krb5_kt_cursor cursor;
152 ret = krb5_kt_default(context, &kt);
156 ret = krb5_kt_start_seq_get (context, kt, &cursor);
158 krb5_kt_close (context, kt);
161 krb5_kt_end_seq_get (context, kt, &cursor);
162 krb5_kt_close (context, kt);
164 str_data[3] = TELQUAL_REPLY;
166 str_data[3] = TELQUAL_IS;
173 kerberos5_send(const char *name, Authenticator *ap)
178 krb5_data cksum_data;
181 if (!UserNameRequested) {
182 if (auth_debug_mode) {
183 printf("Kerberos V5: no user name supplied\r\n");
188 ret = krb5_cc_default(context, &ccache);
190 if (auth_debug_mode) {
191 print_krb5_error(context, ret, "Kerberos V5: could not get default ccache: %s\r\n");
196 if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL)
197 ap_opts = AP_OPTS_MUTUAL_REQUIRED;
200 ap_opts |= AP_OPTS_USE_SUBKEY;
202 ret = krb5_auth_con_init (context, &auth_context);
204 if (auth_debug_mode) {
205 print_krb5_error(context, ret, "Kerberos V5: krb5_auth_con_init failed (%s)\r\n");
210 ret = krb5_auth_con_setaddrs_from_fd (context,
214 if (auth_debug_mode) {
215 print_krb5_error(context, ret, "Kerberos V5:"
216 " krb5_auth_con_setaddrs_from_fd failed (%s)\r\n");
221 krb5_auth_con_setkeytype (context, auth_context, KEYTYPE_DES);
226 cksum_data.length = sizeof(foo);
227 cksum_data.data = foo;
231 krb5_principal service;
235 ret = krb5_sname_to_principal (context,
241 if (auth_debug_mode) {
244 err_str = krb5_get_error_message(context, ret);
245 printf("Kerberosr V5:"
246 " krb5_sname_to_principal(%s) failed (%s)\r\n",
247 RemoteHostName, err_str);
248 krb5_free_error_message(context, err_str);
252 ret = krb5_unparse_name_fixed(context, service, sname, sizeof(sname));
254 if (auth_debug_mode) {
255 print_krb5_error(context, ret, "Kerberos V5:"
256 " krb5_unparse_name_fixed failed (%s)\r\n");
260 printf("[ Trying %s (%s)... ]\r\n", name, sname);
261 ret = krb5_mk_req_exact(context, &auth_context, ap_opts,
263 &cksum_data, ccache, &auth);
264 krb5_free_principal (context, service);
268 if (1 || auth_debug_mode) {
269 print_krb5_error(context, ret, "Kerberos V5: mk_req failed (%s)\r\n");
274 if (!auth_sendname((unsigned char *)UserNameRequested,
275 strlen(UserNameRequested))) {
277 printf("Not enough room for user name\r\n");
280 if (!Data(ap, KRB_AUTH, auth.data, auth.length)) {
282 printf("Not enough room for authentication data\r\n");
285 if (auth_debug_mode) {
286 printf("Sent Kerberos V5 credentials to server\r\n");
292 kerberos5_send_mutual(Authenticator *ap)
294 return kerberos5_send("mutual KERBEROS5", ap);
298 kerberos5_send_oneway(Authenticator *ap)
300 return kerberos5_send("KERBEROS5", ap);
304 kerberos5_is(Authenticator *ap, unsigned char *data, int cnt)
308 krb5_keyblock *key_block;
310 krb5_principal server;
317 auth.data = (char *)data;
322 ret = krb5_auth_con_init (context, &auth_context);
324 Data(ap, KRB_REJECT, "krb5_auth_con_init failed", -1);
325 auth_finished(ap, AUTH_REJECT);
327 print_krb5_error(context, ret, "Kerberos V5: krb5_auth_con_init failed (%s)\r\n");
331 ret = krb5_auth_con_setaddrs_from_fd (context,
335 Data(ap, KRB_REJECT, "krb5_auth_con_setaddrs_from_fd failed", -1);
336 auth_finished(ap, AUTH_REJECT);
338 print_krb5_error(context, ret, "Kerberos V5: "
339 "krb5_auth_con_setaddrs_from_fd failed (%s)\r\n");
343 ret = krb5_sock_to_principal (context,
349 Data(ap, KRB_REJECT, "krb5_sock_to_principal failed", -1);
350 auth_finished(ap, AUTH_REJECT);
352 print_krb5_error(context, ret, "Kerberos V5: "
353 "krb5_sock_to_principal failed (%s)\r\n");
357 ret = krb5_rd_req(context,
365 krb5_free_principal (context, server);
370 err_str = krb5_get_error_message(context, ret);
372 "Read req failed: %s", err_str);
373 krb5_free_error_message(context, err_str);
374 Data(ap, KRB_REJECT, errbuf, -1);
376 printf("%s\r\n", errbuf);
387 ret = krb5_verify_authenticator_checksum(context,
396 err_str = krb5_get_error_message(context, ret);
397 asprintf(&errbuf, "Bad checksum: %s", err_str);
398 krb5_free_error_message(context, err_str);
399 Data(ap, KRB_REJECT, errbuf, -1);
401 printf ("%s\r\n", errbuf);
406 ret = krb5_auth_con_getremotesubkey (context,
411 Data(ap, KRB_REJECT, "krb5_auth_con_getremotesubkey failed", -1);
412 auth_finished(ap, AUTH_REJECT);
414 print_krb5_error(context, ret, "Kerberos V5: "
415 "krb5_auth_con_getremotesubkey failed (%s)\r\n");
419 if (key_block == NULL) {
420 ret = krb5_auth_con_getkey(context,
425 Data(ap, KRB_REJECT, "krb5_auth_con_getkey failed", -1);
426 auth_finished(ap, AUTH_REJECT);
428 print_krb5_error(context, ret, "Kerberos V5: "
429 "krb5_auth_con_getkey failed (%s)\r\n");
432 if (key_block == NULL) {
433 Data(ap, KRB_REJECT, "no subkey received", -1);
434 auth_finished(ap, AUTH_REJECT);
436 printf("Kerberos V5: "
437 "krb5_auth_con_getremotesubkey returned NULL key\r\n");
441 if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) {
442 ret = krb5_mk_rep(context, auth_context, &outbuf);
445 "krb5_mk_rep failed", -1);
446 auth_finished(ap, AUTH_REJECT);
448 print_krb5_error(context, ret, "Kerberos V5: "
449 "krb5_mk_rep failed (%s)\r\n");
452 Data(ap, KRB_RESPONSE, outbuf.data, outbuf.length);
454 if (krb5_unparse_name(context, ticket->client, &name))
457 if(UserNameRequested && krb5_kuserok(context,
459 UserNameRequested)) {
460 Data(ap, KRB_ACCEPT, name, name ? -1 : 0);
461 if (auth_debug_mode) {
462 printf("Kerberos5 identifies him as ``%s''\r\n",
466 if(key_block->keytype == ETYPE_DES_CBC_MD5 ||
467 key_block->keytype == ETYPE_DES_CBC_MD4 ||
468 key_block->keytype == ETYPE_DES_CBC_CRC) {
473 skey.data = key_block->keyvalue.data;
474 encrypt_session_key(&skey, 0);
480 asprintf (&msg, "user `%s' is not authorized to "
482 name ? name : "<unknown>",
483 UserNameRequested ? UserNameRequested : "<nobody>");
485 Data(ap, KRB_REJECT, NULL, 0);
487 Data(ap, KRB_REJECT, (void *)msg, -1);
490 auth_finished (ap, AUTH_REJECT);
491 krb5_free_keyblock_contents(context, key_block);
494 auth_finished(ap, AUTH_USER);
495 krb5_free_keyblock_contents(context, key_block);
500 char ccname[1024]; /* XXX */
503 inbuf.data = (char *)data;
506 pwd = getpwnam (UserNameRequested);
510 snprintf (ccname, sizeof(ccname),
511 "FILE:/tmp/krb5cc_%u", pwd->pw_uid);
513 ret = krb5_cc_resolve (context, ccname, &ccache);
516 print_krb5_error(context, ret, "Kerberos V5: could not get ccache: %s\r\n");
520 ret = krb5_cc_initialize (context,
525 print_krb5_error(context, ret, "Kerberos V5: could not init ccache: %s\r\n");
530 esetenv("KRB5CCNAME", ccname, 1);
532 ret = krb5_rd_cred2 (context,
540 err_str = krb5_get_error_message(context, ret);
542 "Read forwarded creds failed: %s", err_str);
543 krb5_free_error_message(context, err_str);
545 Data(ap, KRB_FORWARD_REJECT, NULL, 0);
547 Data(ap, KRB_FORWARD_REJECT, errbuf, -1);
549 printf("Could not read forwarded credentials: %s\r\n",
553 Data(ap, KRB_FORWARD_ACCEPT, 0, 0);
558 chown (ccname + 5, pwd->pw_uid, -1);
560 printf("Forwarded credentials obtained\r\n");
565 printf("Unknown Kerberos option %d\r\n", data[-1]);
566 Data(ap, KRB_REJECT, 0, 0);
572 kerberos5_reply(Authenticator *ap, unsigned char *data, int cnt)
574 static int mutual_complete = 0;
581 printf("[ Kerberos V5 refuses authentication because %.*s ]\r\n",
584 printf("[ Kerberos V5 refuses authentication ]\r\n");
590 krb5_keyblock *keyblock;
592 if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL &&
594 printf("[ Kerberos V5 accepted you, but didn't provide mutual authentication! ]\r\n");
599 printf("[ Kerberos V5 accepts you as ``%.*s'' ]\r\n", cnt, data);
601 printf("[ Kerberos V5 accepts you ]\r\n");
603 ret = krb5_auth_con_getlocalsubkey (context,
607 ret = krb5_auth_con_getkey (context,
611 print_krb5_error(context, ret, "[ krb5_auth_con_getkey: %s ]\r\n");
618 skey.data = keyblock->keyvalue.data;
619 encrypt_session_key(&skey, 0);
620 krb5_free_keyblock_contents (context, keyblock);
621 auth_finished(ap, AUTH_USER);
622 if (forward_flags & OPTS_FORWARD_CREDS)
623 kerberos5_forward(ap);
627 if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) {
628 /* the rest of the reply should contain a krb_ap_rep */
629 krb5_ap_rep_enc_part *reply;
634 inbuf.data = (char *)data;
636 ret = krb5_rd_rep(context, auth_context, &inbuf, &reply);
638 print_krb5_error(context, ret, "[ Mutual authentication failed: %s ]\r\n");
642 krb5_free_ap_rep_enc_part(context, reply);
646 case KRB_FORWARD_ACCEPT:
647 printf("[ Kerberos V5 accepted forwarded credentials ]\r\n");
649 case KRB_FORWARD_REJECT:
650 printf("[ Kerberos V5 refuses forwarded credentials because %.*s ]\r\n",
655 printf("Unknown Kerberos option %d\r\n", data[-1]);
661 kerberos5_status(Authenticator *ap __unused, char *name, int level)
663 if (level < AUTH_USER)
666 if (UserNameRequested &&
667 krb5_kuserok(context,
671 strcpy(name, UserNameRequested);
677 #define BUMP(buf, len) while (*(buf)) {++(buf), --(len);}
678 #define ADDC(buf, len, c) if ((len) > 0) {*(buf)++ = (c); --(len);}
681 kerberos5_printsub(unsigned char *data, int cnt, unsigned char *buf, int buflen)
685 buf[buflen-1] = '\0'; /* make sure its NULL terminated */
689 case KRB_REJECT: /* Rejected (reason might follow) */
690 strlcpy((char *)buf, " REJECT ", buflen);
693 case KRB_ACCEPT: /* Accepted (name might follow) */
694 strlcpy((char *)buf, " ACCEPT ", buflen);
699 ADDC(buf, buflen, '"');
700 for (i = 4; i < cnt; i++)
701 ADDC(buf, buflen, data[i]);
702 ADDC(buf, buflen, '"');
703 ADDC(buf, buflen, '\0');
707 case KRB_AUTH: /* Authentication data follows */
708 strlcpy((char *)buf, " AUTH", buflen);
712 strlcpy((char *)buf, " RESPONSE", buflen);
715 case KRB_FORWARD: /* Forwarded credentials follow */
716 strlcpy((char *)buf, " FORWARD", buflen);
719 case KRB_FORWARD_ACCEPT: /* Forwarded credentials accepted */
720 strlcpy((char *)buf, " FORWARD_ACCEPT", buflen);
723 case KRB_FORWARD_REJECT: /* Forwarded credentials rejected */
724 /* (reason might follow) */
725 strlcpy((char *)buf, " FORWARD_REJECT", buflen);
729 snprintf(buf, buflen, " %d (unknown)", data[3]);
732 for (i = 4; i < cnt; i++) {
733 snprintf(buf, buflen, " %d", data[i]);
741 kerberos5_forward(Authenticator *ap)
746 krb5_kdc_flags flags;
748 krb5_principal principal;
750 ret = krb5_cc_default (context, &ccache);
753 print_krb5_error(context, ret, "KerberosV5: could not get default ccache: %s\r\n");
757 ret = krb5_cc_get_principal (context, ccache, &principal);
760 print_krb5_error(context, ret, "KerberosV5: could not get principal: %s\r\n");
764 memset (&creds, 0, sizeof(creds));
766 creds.client = principal;
768 ret = krb5_build_principal (context,
770 strlen(principal->realm),
778 print_krb5_error(context, ret, "KerberosV5: could not get principal: %s\r\n");
782 creds.times.endtime = 0;
785 flags.b.forwarded = 1;
786 if (forward_flags & OPTS_FORWARDABLE_CREDS)
787 flags.b.forwardable = 1;
789 ret = krb5_get_forwarded_creds (context,
798 print_krb5_error(context, ret, "Kerberos V5: error getting forwarded creds: %s\r\n");
802 if(!Data(ap, KRB_FORWARD, out_data.data, out_data.length)) {
804 printf("Not enough room for authentication data\r\n");
807 printf("Forwarded local Kerberos V5 credentials to server\r\n");
812 /* if this was a K5 authentication try and join a PAG for the user. */
814 kerberos5_dfspag(void)
817 dfspag = krb5_dfs_pag(context, dfsfwd, ticket->client,