1 /* 2 * Copyright (c) 1997, 1998, 1999 Kungliga Tekniska H�gskolan 3 * (Royal Institute of Technology, Stockholm, Sweden). 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * 3. Neither the name of the Institute nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <krb5_locl.h> 35 36 RCSID("$Id: changepw.c,v 1.20 2000/02/07 13:40:18 joda Exp $"); 37 38 static krb5_error_code 39 get_kdc_address (krb5_context context, 40 krb5_realm realm, 41 struct addrinfo **ai) 42 { 43 krb5_error_code ret; 44 char **hostlist; 45 int port = 0; 46 int error; 47 48 ret = krb5_get_krb_changepw_hst (context, 49 &realm, 50 &hostlist); 51 if (ret) 52 return ret; 53 54 port = ntohs(krb5_getportbyname (context, "kpasswd", "udp", KPASSWD_PORT)); 55 error = roken_getaddrinfo_hostspec(*hostlist, port, ai); 56 57 krb5_free_krbhst (context, hostlist); 58 return error; 59 } 60 61 static krb5_error_code 62 send_request (krb5_context context, 63 krb5_auth_context *auth_context, 64 krb5_creds *creds, 65 int sock, 66 struct sockaddr *sa, 67 int sa_size, 68 char *passwd) 69 { 70 krb5_error_code ret; 71 krb5_data ap_req_data; 72 krb5_data krb_priv_data; 73 krb5_data passwd_data; 74 size_t len; 75 u_char header[6]; 76 u_char *p; 77 struct iovec iov[3]; 78 struct msghdr msghdr; 79 80 krb5_data_zero (&ap_req_data); 81 82 ret = krb5_mk_req_extended (context, 83 auth_context, 84 AP_OPTS_MUTUAL_REQUIRED, 85 NULL, /* in_data */ 86 creds, 87 &ap_req_data); 88 if (ret) 89 return ret; 90 91 passwd_data.data = passwd; 92 passwd_data.length = strlen(passwd); 93 94 krb5_data_zero (&krb_priv_data); 95 96 ret = krb5_mk_priv (context, 97 *auth_context, 98 &passwd_data, 99 &krb_priv_data, 100 NULL); 101 if (ret) 102 goto out2; 103 104 len = 6 + ap_req_data.length + krb_priv_data.length; 105 p = header; 106 *p++ = (len >> 8) & 0xFF; 107 *p++ = (len >> 0) & 0xFF; 108 *p++ = 0; 109 *p++ = 1; 110 *p++ = (ap_req_data.length >> 8) & 0xFF; 111 *p++ = (ap_req_data.length >> 0) & 0xFF; 112 113 memset(&msghdr, 0, sizeof(msghdr)); 114 msghdr.msg_name = (void *)sa; 115 msghdr.msg_namelen = sa_size; 116 msghdr.msg_iov = iov; 117 msghdr.msg_iovlen = sizeof(iov)/sizeof(*iov); 118 #if 0 119 msghdr.msg_control = NULL; 120 msghdr.msg_controllen = 0; 121 #endif 122 123 iov[0].iov_base = (void*)header; 124 iov[0].iov_len = 6; 125 iov[1].iov_base = ap_req_data.data; 126 iov[1].iov_len = ap_req_data.length; 127 iov[2].iov_base = krb_priv_data.data; 128 iov[2].iov_len = krb_priv_data.length; 129 130 if (sendmsg (sock, &msghdr, 0) < 0) 131 ret = errno; 132 133 krb5_data_free (&krb_priv_data); 134 out2: 135 krb5_data_free (&ap_req_data); 136 return ret; 137 } 138 139 static void 140 str2data (krb5_data *d, 141 char *fmt, 142 ...) 143 { 144 va_list args; 145 146 va_start(args, fmt); 147 d->length = vasprintf ((char **)&d->data, fmt, args); 148 va_end(args); 149 } 150 151 static krb5_error_code 152 process_reply (krb5_context context, 153 krb5_auth_context auth_context, 154 int sock, 155 int *result_code, 156 krb5_data *result_code_string, 157 krb5_data *result_string) 158 { 159 krb5_error_code ret; 160 u_char reply[BUFSIZ]; 161 size_t len; 162 u_int16_t pkt_len, pkt_ver; 163 krb5_data ap_rep_data; 164 165 ret = recvfrom (sock, reply, sizeof(reply), 0, NULL, NULL); 166 if (ret < 0) 167 return errno; 168 169 len = ret; 170 pkt_len = (reply[0] << 8) | (reply[1]); 171 pkt_ver = (reply[2] << 8) | (reply[3]); 172 173 if (pkt_len != len) { 174 str2data (result_string, "client: wrong len in reply"); 175 *result_code = KRB5_KPASSWD_MALFORMED; 176 return 0; 177 } 178 if (pkt_ver != 0x0001) { 179 str2data (result_string, 180 "client: wrong version number (%d)", pkt_ver); 181 *result_code = KRB5_KPASSWD_MALFORMED; 182 return 0; 183 } 184 185 ap_rep_data.data = reply + 6; 186 ap_rep_data.length = (reply[4] << 8) | (reply[5]); 187 188 if (ap_rep_data.length) { 189 krb5_ap_rep_enc_part *ap_rep; 190 krb5_data priv_data; 191 u_char *p; 192 193 ret = krb5_rd_rep (context, 194 auth_context, 195 &ap_rep_data, 196 &ap_rep); 197 if (ret) 198 return ret; 199 200 krb5_free_ap_rep_enc_part (context, ap_rep); 201 202 priv_data.data = (u_char*)ap_rep_data.data + ap_rep_data.length; 203 priv_data.length = len - ap_rep_data.length - 6; 204 205 ret = krb5_rd_priv (context, 206 auth_context, 207 &priv_data, 208 result_code_string, 209 NULL); 210 if (ret) { 211 krb5_data_free (result_code_string); 212 return ret; 213 } 214 215 if (result_code_string->length < 2) { 216 *result_code = KRB5_KPASSWD_MALFORMED; 217 str2data (result_string, 218 "client: bad length in result"); 219 return 0; 220 } 221 p = result_code_string->data; 222 223 *result_code = (p[0] << 8) | p[1]; 224 krb5_data_copy (result_string, 225 (unsigned char*)result_code_string->data + 2, 226 result_code_string->length - 2); 227 return 0; 228 } else { 229 KRB_ERROR error; 230 size_t size; 231 u_char *p; 232 233 ret = decode_KRB_ERROR(reply + 6, len - 6, &error, &size); 234 if (ret) { 235 return ret; 236 } 237 if (error.e_data->length < 2) { 238 krb5_warnx (context, "too short e_data to print anything usable"); 239 return 1; 240 } 241 242 p = error.e_data->data; 243 *result_code = (p[0] << 8) | p[1]; 244 krb5_data_copy (result_string, 245 p + 2, 246 error.e_data->length - 2); 247 return 0; 248 } 249 } 250 251 krb5_error_code 252 krb5_change_password (krb5_context context, 253 krb5_creds *creds, 254 char *newpw, 255 int *result_code, 256 krb5_data *result_code_string, 257 krb5_data *result_string) 258 { 259 krb5_error_code ret; 260 krb5_auth_context auth_context = NULL; 261 int sock; 262 int i; 263 struct addrinfo *ai, *a; 264 265 ret = krb5_auth_con_init (context, &auth_context); 266 if (ret) 267 return ret; 268 269 ret = get_kdc_address (context, creds->client->realm, &ai); 270 if (ret) 271 goto out; 272 273 krb5_auth_con_setflags (context, auth_context, 274 KRB5_AUTH_CONTEXT_DO_SEQUENCE); 275 276 for (a = ai; a != NULL; a = a->ai_next) { 277 sock = socket (a->ai_family, a->ai_socktype, a->ai_protocol); 278 if (sock < 0) 279 continue; 280 281 for (i = 0; i < 5; ++i) { 282 fd_set fdset; 283 struct timeval tv; 284 285 ret = send_request (context, 286 &auth_context, 287 creds, 288 sock, 289 a->ai_addr, 290 a->ai_addrlen, 291 newpw); 292 if (ret) 293 goto out; 294 295 FD_ZERO(&fdset); 296 FD_SET(sock, &fdset); 297 tv.tv_usec = 0; 298 tv.tv_sec = 1 << i; 299 300 ret = select (sock + 1, &fdset, NULL, NULL, &tv); 301 if (ret < 0 && errno != EINTR) 302 goto out; 303 if (ret == 1) 304 break; 305 } 306 if (i == 5) { 307 ret = KRB5_KDC_UNREACH; 308 close (sock); 309 continue; 310 } 311 312 ret = process_reply (context, 313 auth_context, 314 sock, 315 result_code, 316 result_code_string, 317 result_string); 318 close (sock); 319 if (ret == 0) 320 break; 321 } 322 freeaddrinfo (ai); 323 324 out: 325 krb5_auth_con_free (context, auth_context); 326 return ret; 327 } 328