1/*	$NetBSD: gss-serv-krb5.c,v 1.12 2019/01/27 02:08:33 pgoyette Exp $	*/
2/* $OpenBSD: gss-serv-krb5.c,v 1.9 2018/07/09 21:37:55 markus Exp $ */
3
4/*
5 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28#include "includes.h"
29__RCSID("$NetBSD: gss-serv-krb5.c,v 1.12 2019/01/27 02:08:33 pgoyette Exp $");
30#ifdef GSSAPI
31#ifdef KRB5
32
33#include <sys/types.h>
34
35#include <stdarg.h>
36#include <string.h>
37
38#include "xmalloc.h"
39#include "sshkey.h"
40#include "hostfile.h"
41#include "auth.h"
42#include "log.h"
43#include "misc.h"
44#include "servconf.h"
45
46#include "ssh-gss.h"
47
48extern ServerOptions options;
49
50#include <krb5.h>
51#include <gssapi/gssapi_krb5.h>
52
53static krb5_context krb_context = NULL;
54
55/* Initialise the krb5 library, for the stuff that GSSAPI won't do */
56
57static int
58ssh_gssapi_krb5_init(void)
59{
60	krb5_error_code problem;
61
62	if (krb_context != NULL)
63		return 1;
64
65	problem = krb5_init_context(&krb_context);
66	if (problem) {
67		logit("Cannot initialize krb5 context");
68		return 0;
69	}
70#ifdef isneeded
71	krb5_init_ets(krb_context);
72#endif
73
74	return 1;
75}
76
77/* Check if this user is OK to login. This only works with krb5 - other
78 * GSSAPI mechanisms will need their own.
79 * Returns true if the user is OK to log in, otherwise returns 0
80 */
81
82static int
83ssh_gssapi_krb5_userok(ssh_gssapi_client *client, char *name)
84{
85	krb5_principal princ;
86	int retval;
87	const char *errmsg;
88
89	if (ssh_gssapi_krb5_init() == 0)
90		return 0;
91
92	if ((retval = krb5_parse_name(krb_context, client->exportedname.value,
93	    &princ))) {
94		errmsg = krb5_get_error_message(krb_context, retval);
95		logit("krb5_parse_name(): %.100s", errmsg);
96		krb5_free_error_message(krb_context, errmsg);
97		return 0;
98	}
99	if (krb5_kuserok(krb_context, princ, name)) {
100		retval = 1;
101		logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
102		    name, (char *)client->displayname.value);
103	} else
104		retval = 0;
105
106	krb5_free_principal(krb_context, princ);
107	return retval;
108}
109
110
111/* This writes out any forwarded credentials from the structure populated
112 * during userauth. Called after we have setuid to the user */
113
114static void
115ssh_gssapi_krb5_storecreds(ssh_gssapi_client *client)
116{
117	krb5_ccache ccache;
118	krb5_error_code problem;
119	krb5_principal princ;
120	OM_uint32 maj_status, min_status;
121	size_t len;
122	const char *errmsg;
123
124	if (client->creds == NULL) {
125		debug("No credentials stored");
126		return;
127	}
128
129	if (ssh_gssapi_krb5_init() == 0)
130		return;
131
132	if ((problem = krb5_cc_new_unique(krb_context, krb5_fcc_ops.prefix,
133	    NULL, &ccache)) != 0) {
134		errmsg = krb5_get_error_message(krb_context, problem);
135		logit("krb5_cc_new_unique(): %.100s", errmsg);
136		krb5_free_error_message(krb_context, errmsg);
137		return;
138	}
139
140	if ((problem = krb5_parse_name(krb_context,
141	    client->exportedname.value, &princ))) {
142		errmsg = krb5_get_error_message(krb_context, problem);
143		logit("krb5_parse_name(): %.100s", errmsg);
144		krb5_free_error_message(krb_context, errmsg);
145		krb5_cc_destroy(krb_context, ccache);
146		return;
147	}
148
149	if ((problem = krb5_cc_initialize(krb_context, ccache, princ))) {
150		errmsg = krb5_get_error_message(krb_context, problem);
151		logit("krb5_cc_initialize(): %.100s", errmsg);
152		krb5_free_error_message(krb_context, errmsg);
153		krb5_free_principal(krb_context, princ);
154		krb5_cc_destroy(krb_context, ccache);
155		return;
156	}
157
158	krb5_free_principal(krb_context, princ);
159
160	if ((maj_status = gss_krb5_copy_ccache(&min_status,
161	    client->creds, ccache))) {
162		logit("gss_krb5_copy_ccache() failed");
163		krb5_cc_destroy(krb_context, ccache);
164		return;
165	}
166
167	client->store.filename = xstrdup(krb5_cc_get_name(krb_context, ccache));
168	client->store.envvar = __UNCONST("KRB5CCNAME");
169	len = strlen(client->store.filename) + 6;
170	client->store.envval = xmalloc(len);
171	snprintf(client->store.envval, len, "FILE:%s", client->store.filename);
172
173#ifdef USE_PAM
174	if (options.use_pam)
175		do_pam_putenv(client->store.envvar, client->store.envval);
176#endif
177
178	krb5_cc_close(krb_context, ccache);
179
180	return;
181}
182
183ssh_gssapi_mech gssapi_kerberos_mech = {
184	"toWM5Slw5Ew8Mqkay+al2g==",
185	"Kerberos",
186	{9, __UNCONST("\x2A\x86\x48\x86\xF7\x12\x01\x02\x02")},
187	NULL,
188	&ssh_gssapi_krb5_userok,
189	NULL,
190	&ssh_gssapi_krb5_storecreds
191};
192
193#endif /* KRB5 */
194
195#endif /* GSSAPI */
196