1 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
2 /* lib/krb5/os/changepw.c */
3 /*
4 * Copyright 1990,1999,2001,2008 by the Massachusetts Institute of Technology.
5 * All Rights Reserved.
6 *
7 * Export of this software from the United States of America may
8 * require a specific license from the United States Government.
9 * It is the responsibility of any person or organization contemplating
10 * export to obtain such a license before exporting.
11 *
12 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
13 * distribute this software and its documentation for any purpose and
14 * without fee is hereby granted, provided that the above copyright
15 * notice appear in all copies and that both that copyright notice and
16 * this permission notice appear in supporting documentation, and that
17 * the name of M.I.T. not be used in advertising or publicity pertaining
18 * to distribution of the software without specific, written prior
19 * permission. Furthermore if you modify this software you must label
20 * your software as modified software and not distribute it in such a
21 * fashion that it might be confused with the original M.I.T. software.
22 * M.I.T. makes no representations about the suitability of
23 * this software for any purpose. It is provided "as is" without express
24 * or implied warranty.
25 */
26
27 /*
28 * krb5_set_password - Implements set password per RFC 3244
29 * Added by Paul W. Nelson, Thursby Software Systems, Inc.
30 * Modified by Todd Stecher, Isilon Systems, to use krb1.4 socket
31 * infrastructure
32 */
33
34 #include "k5-int.h"
35 #include "fake-addrinfo.h"
36 #include "os-proto.h"
37 #include "../krb/auth_con.h"
38 #include "../krb/int-proto.h"
39
40 #include <stdio.h>
41 #include <errno.h>
42
43 #ifndef GETSOCKNAME_ARG3_TYPE
44 #define GETSOCKNAME_ARG3_TYPE int
45 #endif
46
47 struct sendto_callback_context {
48 krb5_context context;
49 krb5_auth_context auth_context;
50 krb5_principal set_password_for;
51 const char *newpw;
52 krb5_data ap_req;
53 krb5_ui_4 remote_seq_num, local_seq_num;
54 };
55
56 /*
57 * Wrapper function for the two backends
58 */
59
60 static krb5_error_code
locate_kpasswd(krb5_context context,const krb5_data * realm,struct serverlist * serverlist)61 locate_kpasswd(krb5_context context, const krb5_data *realm,
62 struct serverlist *serverlist)
63 {
64 krb5_error_code code;
65
66 code = k5_locate_server(context, realm, serverlist, locate_service_kpasswd,
67 FALSE);
68 if (code == KRB5_REALM_CANT_RESOLVE || code == KRB5_REALM_UNKNOWN) {
69 code = k5_locate_server(context, realm, serverlist,
70 locate_service_kadmin, TRUE);
71 if (!code) {
72 /* Success with admin_server but now we need to change the port
73 * number to use DEFAULT_KPASSWD_PORT and the transport. */
74 size_t i;
75 for (i = 0; i < serverlist->nservers; i++) {
76 struct server_entry *s = &serverlist->servers[i];
77
78 if (s->transport == TCP)
79 s->transport = TCP_OR_UDP;
80 if (s->hostname != NULL)
81 s->port = DEFAULT_KPASSWD_PORT;
82 else if (s->family == AF_INET)
83 ss2sin(&s->addr)->sin_port = htons(DEFAULT_KPASSWD_PORT);
84 else if (s->family == AF_INET6)
85 ss2sin6(&s->addr)->sin6_port = htons(DEFAULT_KPASSWD_PORT);
86 }
87 }
88 }
89 return (code);
90 }
91
92
93 /**
94 * This routine is used for a callback in sendto_kdc.c code. Simply
95 * put, we need the client addr to build the krb_priv portion of the
96 * password request.
97 */
98
99
100 static void
kpasswd_sendto_msg_cleanup(void * data,krb5_data * message)101 kpasswd_sendto_msg_cleanup(void *data, krb5_data *message)
102 {
103 struct sendto_callback_context *ctx = data;
104
105 krb5_free_data_contents(ctx->context, message);
106 }
107
108
109 static int
kpasswd_sendto_msg_callback(SOCKET fd,void * data,krb5_data * message)110 kpasswd_sendto_msg_callback(SOCKET fd, void *data, krb5_data *message)
111 {
112 krb5_error_code code = 0;
113 struct sockaddr_storage local_addr;
114 krb5_address local_kaddr;
115 struct sendto_callback_context *ctx = data;
116 GETSOCKNAME_ARG3_TYPE addrlen;
117 krb5_data output;
118 krb5_address **addrs = NULL;
119
120 memset (message, 0, sizeof(krb5_data));
121
122 /*
123 * We need the local addr from the connection socket
124 */
125 addrlen = sizeof(local_addr);
126
127 if (getsockname(fd, ss2sa(&local_addr), &addrlen) < 0) {
128 code = SOCKET_ERRNO;
129 goto cleanup;
130 }
131
132 /* some brain-dead OS's don't return useful information from
133 * the getsockname call. Namely, windows and solaris. */
134
135 if (local_addr.ss_family == AF_INET &&
136 ss2sin(&local_addr)->sin_addr.s_addr != 0) {
137 local_kaddr.addrtype = ADDRTYPE_INET;
138 local_kaddr.length = sizeof(ss2sin(&local_addr)->sin_addr);
139 local_kaddr.contents = (krb5_octet *) &ss2sin(&local_addr)->sin_addr;
140 } else if (local_addr.ss_family == AF_INET6 &&
141 memcmp(ss2sin6(&local_addr)->sin6_addr.s6_addr,
142 in6addr_any.s6_addr, sizeof(in6addr_any.s6_addr)) != 0) {
143 local_kaddr.addrtype = ADDRTYPE_INET6;
144 local_kaddr.length = sizeof(ss2sin6(&local_addr)->sin6_addr);
145 local_kaddr.contents = (krb5_octet *) &ss2sin6(&local_addr)->sin6_addr;
146 #ifndef _WIN32
147 } else if (local_addr.ss_family == AF_UNIX) {
148 /* There is no standard way to represent UNIX domain sockets. Assume
149 * that the receiver will accept a directional address. */
150 local_kaddr = k5_addr_directional_init;
151 #endif
152 } else {
153 code = krb5_os_localaddr(ctx->context, &addrs);
154 if (code)
155 goto cleanup;
156 local_kaddr = *addrs[0];
157 }
158
159
160 /*
161 * TBD: Does this tamper w/ the auth context in such a way
162 * to break us? Yes - provide 1 per conn-state / host...
163 */
164
165
166 if ((code = krb5_auth_con_setaddrs(ctx->context, ctx->auth_context,
167 &local_kaddr, NULL)))
168 goto cleanup;
169
170 ctx->auth_context->remote_seq_number = ctx->remote_seq_num;
171 ctx->auth_context->local_seq_number = ctx->local_seq_num;
172
173 if (ctx->set_password_for)
174 code = krb5int_mk_setpw_req(ctx->context,
175 ctx->auth_context,
176 &ctx->ap_req,
177 ctx->set_password_for,
178 ctx->newpw,
179 &output);
180 else
181 code = krb5int_mk_chpw_req(ctx->context,
182 ctx->auth_context,
183 &ctx->ap_req,
184 ctx->newpw,
185 &output);
186 if (code)
187 goto cleanup;
188
189 message->length = output.length;
190 message->data = output.data;
191
192 cleanup:
193 krb5_free_addresses(ctx->context, addrs);
194 return code;
195 }
196
197
198 /*
199 ** The logic for setting and changing a password is mostly the same
200 ** change_set_password handles both cases
201 ** if set_password_for is NULL, then a password change is performed,
202 ** otherwise, the password is set for the principal indicated in set_password_for
203 */
204 static krb5_error_code
change_set_password(krb5_context context,krb5_creds * creds,const char * newpw,krb5_principal set_password_for,int * result_code,krb5_data * result_code_string,krb5_data * result_string)205 change_set_password(krb5_context context,
206 krb5_creds *creds,
207 const char *newpw,
208 krb5_principal set_password_for,
209 int *result_code,
210 krb5_data *result_code_string,
211 krb5_data *result_string)
212 {
213 krb5_data chpw_rep;
214 GETSOCKNAME_ARG3_TYPE addrlen;
215 krb5_error_code code = 0;
216 char *code_string;
217 int local_result_code;
218
219 struct sendto_callback_context callback_ctx;
220 struct sendto_callback_info callback_info;
221 struct sockaddr_storage remote_addr;
222 struct serverlist sl = SERVERLIST_INIT;
223
224 memset(&chpw_rep, 0, sizeof(krb5_data));
225 memset( &callback_ctx, 0, sizeof(struct sendto_callback_context));
226 callback_ctx.context = context;
227 callback_ctx.newpw = newpw;
228 callback_ctx.set_password_for = set_password_for;
229
230 if ((code = krb5_auth_con_init(callback_ctx.context,
231 &callback_ctx.auth_context)))
232 goto cleanup;
233
234 if ((code = krb5_mk_req_extended(callback_ctx.context,
235 &callback_ctx.auth_context,
236 AP_OPTS_USE_SUBKEY,
237 NULL,
238 creds,
239 &callback_ctx.ap_req)))
240 goto cleanup;
241
242 callback_ctx.remote_seq_num = callback_ctx.auth_context->remote_seq_number;
243 callback_ctx.local_seq_num = callback_ctx.auth_context->local_seq_number;
244
245 code = locate_kpasswd(callback_ctx.context, &creds->server->realm, &sl);
246 if (code)
247 goto cleanup;
248
249 addrlen = sizeof(remote_addr);
250
251 callback_info.data = &callback_ctx;
252 callback_info.pfn_callback = kpasswd_sendto_msg_callback;
253 callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup;
254 krb5_free_data_contents(callback_ctx.context, &chpw_rep);
255
256 /* UDP retransmits may be seen as replays. Only try UDP after other
257 * transports fail completely. */
258 code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm,
259 &sl, NO_UDP, &callback_info, &chpw_rep,
260 ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL);
261 if (code == KRB5_KDC_UNREACH) {
262 code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm,
263 &sl, ONLY_UDP, &callback_info, &chpw_rep,
264 ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL);
265 }
266 if (code)
267 goto cleanup;
268
269 code = krb5int_rd_chpw_rep(callback_ctx.context,
270 callback_ctx.auth_context,
271 &chpw_rep, &local_result_code,
272 result_string);
273
274 if (code)
275 goto cleanup;
276
277 if (result_code)
278 *result_code = local_result_code;
279
280 if (result_code_string) {
281 code = krb5_chpw_result_code_string(callback_ctx.context,
282 local_result_code,
283 &code_string);
284 if (code)
285 goto cleanup;
286
287 result_code_string->length = strlen(code_string);
288 result_code_string->data = malloc(result_code_string->length);
289 if (result_code_string->data == NULL) {
290 code = ENOMEM;
291 goto cleanup;
292 }
293 strncpy(result_code_string->data, code_string, result_code_string->length);
294 }
295
296 cleanup:
297 if (callback_ctx.auth_context != NULL)
298 krb5_auth_con_free(callback_ctx.context, callback_ctx.auth_context);
299
300 k5_free_serverlist(&sl);
301 krb5_free_data_contents(callback_ctx.context, &callback_ctx.ap_req);
302 krb5_free_data_contents(callback_ctx.context, &chpw_rep);
303
304 return(code);
305 }
306
307 krb5_error_code KRB5_CALLCONV
krb5_change_password(krb5_context context,krb5_creds * creds,const char * newpw,int * result_code,krb5_data * result_code_string,krb5_data * result_string)308 krb5_change_password(krb5_context context,
309 krb5_creds *creds,
310 const char *newpw,
311 int *result_code,
312 krb5_data *result_code_string,
313 krb5_data *result_string)
314 {
315 return change_set_password(context, creds, newpw, NULL,
316 result_code, result_code_string, result_string );
317 }
318
319 /*
320 * krb5_set_password - Implements set password per RFC 3244
321 *
322 */
323
324 krb5_error_code KRB5_CALLCONV
krb5_set_password(krb5_context context,krb5_creds * creds,const char * newpw,krb5_principal change_password_for,int * result_code,krb5_data * result_code_string,krb5_data * result_string)325 krb5_set_password(krb5_context context,
326 krb5_creds *creds,
327 const char *newpw,
328 krb5_principal change_password_for,
329 int *result_code,
330 krb5_data *result_code_string,
331 krb5_data *result_string
332 )
333 {
334 return change_set_password(context, creds, newpw, change_password_for,
335 result_code, result_code_string, result_string );
336 }
337
338 krb5_error_code KRB5_CALLCONV
krb5_set_password_using_ccache(krb5_context context,krb5_ccache ccache,const char * newpw,krb5_principal change_password_for,int * result_code,krb5_data * result_code_string,krb5_data * result_string)339 krb5_set_password_using_ccache(krb5_context context,
340 krb5_ccache ccache,
341 const char *newpw,
342 krb5_principal change_password_for,
343 int *result_code,
344 krb5_data *result_code_string,
345 krb5_data *result_string
346 )
347 {
348 krb5_creds creds;
349 krb5_creds *credsp;
350 krb5_error_code code;
351
352 /*
353 ** get the proper creds for use with krb5_set_password -
354 */
355 memset (&creds, 0, sizeof(creds));
356 /*
357 ** first get the principal for the password service -
358 */
359 code = krb5_cc_get_principal (context, ccache, &creds.client);
360 if (!code) {
361 code = krb5_build_principal(context, &creds.server,
362 change_password_for->realm.length,
363 change_password_for->realm.data,
364 "kadmin", "changepw", NULL);
365 if (!code) {
366 code = krb5_get_credentials(context, 0, ccache, &creds, &credsp);
367 if (!code) {
368 code = krb5_set_password(context, credsp, newpw, change_password_for,
369 result_code, result_code_string,
370 result_string);
371 krb5_free_creds(context, credsp);
372 }
373 }
374 krb5_free_cred_contents(context, &creds);
375 }
376 return code;
377 }
378