verify_init.c revision 102644 
1/*
2 * Copyright (c) 1997 - 2002 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5_locl.h"
35
36RCSID("$Id: verify_init.c,v 1.17 2002/08/20 14:47:59 joda Exp $");
37
38void
39krb5_verify_init_creds_opt_init(krb5_verify_init_creds_opt *options)
40{
41    memset (options, 0, sizeof(*options));
42}
43
44void
45krb5_verify_init_creds_opt_set_ap_req_nofail(krb5_verify_init_creds_opt *options,
46					     int ap_req_nofail)
47{
48    options->flags |= KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL;
49    options->ap_req_nofail = ap_req_nofail;
50}
51
52/*
53 *
54 */
55
56static krb5_boolean
57fail_verify_is_ok (krb5_context context,
58		   krb5_verify_init_creds_opt *options)
59{
60    if ((options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL
61	 && options->ap_req_nofail != 0)
62	|| krb5_config_get_bool (context,
63				 NULL,
64				 "libdefaults",
65				 "verify_ap_req_nofail",
66				 NULL))
67	return FALSE;
68    else
69	return TRUE;
70}
71
72krb5_error_code
73krb5_verify_init_creds(krb5_context context,
74		       krb5_creds *creds,
75		       krb5_principal ap_req_server,
76		       krb5_keytab ap_req_keytab,
77		       krb5_ccache *ccache,
78		       krb5_verify_init_creds_opt *options)
79{
80    krb5_error_code ret;
81    krb5_data req;
82    krb5_ccache local_ccache = NULL;
83    krb5_keytab_entry entry;
84    krb5_creds *new_creds = NULL;
85    krb5_auth_context auth_context = NULL;
86    krb5_principal server = NULL;
87    krb5_keytab keytab = NULL;
88
89    krb5_data_zero (&req);
90    memset (&entry, 0, sizeof(entry));
91
92    if (ap_req_server == NULL) {
93	char local_hostname[MAXHOSTNAMELEN];
94
95	if (gethostname (local_hostname, sizeof(local_hostname)) < 0) {
96	    ret = errno;
97	    krb5_set_error_string (context, "gethostname: %s",
98				   strerror(ret));
99	    return ret;
100	}
101
102	ret = krb5_sname_to_principal (context,
103				       local_hostname,
104				       "host",
105				       KRB5_NT_SRV_HST,
106				       &server);
107	if (ret)
108	    goto cleanup;
109    } else
110	server = ap_req_server;
111
112    if (ap_req_keytab == NULL) {
113	ret = krb5_kt_default (context, &keytab);
114	if (ret)
115	    goto cleanup;
116    } else
117	keytab = ap_req_keytab;
118
119    if (ccache && *ccache)
120	local_ccache = *ccache;
121    else {
122	ret = krb5_cc_gen_new (context, &krb5_mcc_ops, &local_ccache);
123	if (ret)
124	    goto cleanup;
125	ret = krb5_cc_initialize (context,
126				  local_ccache,
127				  creds->client);
128	if (ret)
129	    goto cleanup;
130	ret = krb5_cc_store_cred (context,
131				  local_ccache,
132				  creds);
133	if (ret)
134	    goto cleanup;
135    }
136
137    if (!krb5_principal_compare (context, server, creds->server)) {
138	krb5_creds match_cred;
139
140	memset (&match_cred, 0, sizeof(match_cred));
141
142	match_cred.client = creds->client;
143	match_cred.server = server;
144
145	ret = krb5_get_credentials (context,
146				    0,
147				    local_ccache,
148				    &match_cred,
149				    &new_creds);
150	if (ret) {
151	    if (fail_verify_is_ok (context, options))
152		ret = 0;
153	    goto cleanup;
154	}
155	creds = new_creds;
156    }
157
158    ret = krb5_mk_req_extended (context,
159				&auth_context,
160				0,
161				NULL,
162				creds,
163				&req);
164
165    krb5_auth_con_free (context, auth_context);
166    auth_context = NULL;
167
168    if (ret)
169	goto cleanup;
170
171    ret = krb5_rd_req (context,
172		       &auth_context,
173		       &req,
174		       server,
175		       keytab,
176		       0,
177		       NULL);
178
179    if (ret == KRB5_KT_NOTFOUND && fail_verify_is_ok (context, options))
180	ret = 0;
181cleanup:
182    if (auth_context)
183	krb5_auth_con_free (context, auth_context);
184    krb5_data_free (&req);
185    krb5_kt_free_entry (context, &entry);
186    if (new_creds != NULL)
187	krb5_free_creds (context, new_creds);
188    if (ap_req_server == NULL && server)
189	krb5_free_principal (context, server);
190    if (ap_req_keytab == NULL && keytab)
191	krb5_kt_close (context, keytab);
192    if (local_ccache != NULL
193	&&
194	(ccache == NULL
195	 || (ret != 0 && *ccache == NULL)))
196	krb5_cc_destroy (context, local_ccache);
197
198    if (ret == 0 && ccache != NULL && *ccache == NULL)
199	*ccache = local_ccache;
200
201    return ret;
202}
203