sendauth.c revision 55682 
1/*
2 * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska H�gskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34#include "krb5_locl.h"
35
36RCSID("$Id: sendauth.c,v 1.17 1999/12/02 17:05:12 joda Exp $");
37
38/*
39 * The format seems to be:
40 * client -> server
41 *
42 * 4 bytes - length
43 * KRB5_SENDAUTH_V1.0 (including zero)
44 * 4 bytes - length
45 * protocol string (with terminating zero)
46 *
47 * server -> client
48 * 1 byte - (0 = OK, else some kind of error)
49 *
50 * client -> server
51 * 4 bytes - length
52 * AP-REQ
53 *
54 * server -> client
55 * 4 bytes - length (0 = OK, else length of error)
56 * (error)
57 *
58 * if(mutual) {
59 * server -> client
60 * 4 bytes - length
61 * AP-REP
62 * }
63 */
64
65krb5_error_code
66krb5_sendauth(krb5_context context,
67	      krb5_auth_context *auth_context,
68	      krb5_pointer p_fd,
69	      const char *appl_version,
70	      krb5_principal client,
71	      krb5_principal server,
72	      krb5_flags ap_req_options,
73	      krb5_data *in_data,
74	      krb5_creds *in_creds,
75	      krb5_ccache ccache,
76	      krb5_error **ret_error,
77	      krb5_ap_rep_enc_part **rep_result,
78	      krb5_creds **out_creds)
79{
80    krb5_error_code ret;
81    u_int32_t len, net_len;
82    const char *version = KRB5_SENDAUTH_VERSION;
83    u_char repl;
84    krb5_data ap_req, error_data;
85    krb5_creds this_cred;
86    krb5_principal this_client = NULL;
87    krb5_creds *creds;
88    ssize_t sret;
89
90    len = strlen(version) + 1;
91    net_len = htonl(len);
92    if (krb5_net_write (context, p_fd, &net_len, 4) != 4
93	|| krb5_net_write (context, p_fd, version, len) != len)
94	return errno;
95
96    len = strlen(appl_version) + 1;
97    net_len = htonl(len);
98    if (krb5_net_write (context, p_fd, &net_len, 4) != 4
99	|| krb5_net_write (context, p_fd, appl_version, len) != len)
100	return errno;
101
102    sret = krb5_net_read (context, p_fd, &repl, sizeof(repl));
103    if (sret < 0)
104	return errno;
105    else if (sret != sizeof(repl))
106	return KRB5_SENDAUTH_BADRESPONSE;
107
108    if (repl != 0)
109	return KRB5_SENDAUTH_REJECTED;
110
111    if (in_creds == NULL) {
112	if (ccache == NULL) {
113	    ret = krb5_cc_default (context, &ccache);
114	    if (ret)
115		return ret;
116	}
117
118	if (client == NULL) {
119	    ret = krb5_cc_get_principal (context, ccache, &this_client);
120	    if (ret)
121		return ret;
122	    client = this_client;
123	}
124	memset(&this_cred, 0, sizeof(this_cred));
125	this_cred.client = client;
126	this_cred.server = server;
127	this_cred.times.endtime = 0;
128	this_cred.ticket.length = 0;
129	in_creds = &this_cred;
130    }
131    if (in_creds->ticket.length == 0) {
132	ret = krb5_get_credentials (context, 0, ccache, in_creds, &creds);
133	if (ret)
134	    return ret;
135    } else {
136	creds = in_creds;
137    }
138    ret = krb5_mk_req_extended (context,
139				auth_context,
140				ap_req_options,
141				in_data,
142				creds,
143				&ap_req);
144
145    if (out_creds)
146	*out_creds = creds;
147    else
148	krb5_free_creds(context, creds);
149    if(this_client)
150	krb5_free_principal(context, this_client);
151
152    if (ret)
153	return ret;
154
155    ret = krb5_write_message (context,
156			      p_fd,
157			      &ap_req);
158    if (ret)
159	return ret;
160
161    krb5_data_free (&ap_req);
162
163    ret = krb5_read_message (context, p_fd, &error_data);
164    if (ret)
165	return ret;
166
167    if (error_data.length != 0) {
168	KRB_ERROR error;
169
170	ret = krb5_rd_error (context, &error_data, &error);
171	krb5_data_free (&error_data);
172	if (ret == 0) {
173	    if (ret_error != NULL) {
174		*ret_error = malloc (sizeof(krb5_error));
175		if (*ret_error == NULL) {
176		    free_KRB_ERROR(&error);
177		} else {
178		    **ret_error = error;
179		}
180	    } else {
181		free_KRB_ERROR(&error);
182	    }
183	    return error.error_code;
184	} else
185	    return ret;
186    }
187
188    if (ap_req_options & AP_OPTS_MUTUAL_REQUIRED) {
189	krb5_data ap_rep;
190	krb5_ap_rep_enc_part *ignore;
191
192	krb5_data_zero (&ap_rep);
193	ret = krb5_read_message (context,
194				 p_fd,
195				 &ap_rep);
196	if (ret)
197	    return ret;
198
199	ret = krb5_rd_rep (context, *auth_context, &ap_rep,
200			   rep_result ? rep_result : &ignore);
201	if (ret)
202	    return ret;
203	if (rep_result == NULL)
204	    krb5_free_ap_rep_enc_part (context, ignore);
205	krb5_data_free (&ap_rep);
206    }
207    return 0;
208}
209