krb5auth.c

Go to the documentation of this file.

/* $Id: krb5auth.c,v 1.4 2005/01/21 04:49:41 seymour Exp $ */
/* $UTK_Copyright: $ */

#ifdef KERBEROS5
#include <stdio.h>
#include <errno.h>
#include <unistd.h>
#include <sys/socket.h>
#include <signal.h>
#include <time.h>
#include <krb5.h>
#include <com_err.h>
#include "proxylib.h"

PROXY_KRB5_INFO proxy_krb5_info;

char gridsolve_version[] = "GRIDSOLVE V0.1";

int
proxy_send_krb5_credentials (char *server_hostname, int comm)
{
  krb5_context context;
  krb5_auth_context auth_context = 0;
  krb5_error_code retval;
  krb5_principal client, server;
  krb5_ccache cc;

  retval = krb5_init_context (&context);
  if (retval) {
    fprintf(stderr, "krb5_init_context failed: %s\n", error_message(retval));
    return -1;
  } 

  /*
   * XXX we're picking the service name "GridSolve" arbitrarily;
   * this should be registered with the appropriate folks.
   */

  retval = krb5_sname_to_principal(context, server_hostname,
                   "GridSolve",
                   KRB5_NT_SRV_HST, &server);
  if (retval) {
    fprintf (stderr, "krb5_sname_to_principal failed: %s\n",
         error_message (retval));
    return -1;
  }

  retval = krb5_cc_default (context, &cc);

  if (retval) {
    fprintf (stderr, "krb5_cc_default failed: %s\n",
         error_message (retval));
    krb5_free_principal (context, server);
    krb5_cc_close (context, cc);
    return -1;
  }

  retval = krb5_cc_get_principal (context, cc, &client);

  if (retval) {
    fprintf (stderr, "krb5_cc_get_principal failed: %s\n",
         error_message (retval));
    krb5_free_principal (context, server);
    krb5_cc_close (context, cc);
    return -1;
  }

  retval = krb5_sendauth (context, &auth_context,
              (krb5_context) &comm,
              gridsolve_version,
              client, server,
              AP_OPTS_MUTUAL_REQUIRED | AP_OPTS_USE_SUBKEY,
              NULL, NULL, cc, 0, 0, NULL);
  
  if (retval) {
    fprintf (stderr, "krb5_sendauth failed: %s\n",
         error_message (retval));
    krb5_free_principal (context, client);
    krb5_free_principal (context, server);
    krb5_cc_close (context, cc);
    return -1;
  }

  return 0;
}

int
proxy_check_principal_name(char *name)
{
    FILE *fp;
    char buf[1024];
    
    if ((fp = fopen (proxy_krb5_info.users_file, "r")) == NULL) {
    fprintf (stderr, "cannot open %s: %s\n", proxy_krb5_info.users_file, strerror (errno));
    return -1;
    }
    while (fgets (buf, sizeof (buf), fp)) {
    char *ptr;
    
    /* if '#' appears in the line, ignore it and everything following */
    if ( (ptr = strchr (buf, '#')) )
        *ptr = '\0';
    
    /* delete trailing spaces */
    ptr = buf + strlen (buf);
    while (ptr > buf && (ptr[-1] == ' ' || ptr[-1] == '\t' ||
                 ptr[-1] == '\n' || ptr[-1] == '\r'))
        *--ptr = '\0';
    
    /* skip over leading spaces */
    for (ptr = buf; *ptr == ' ' || *ptr == '\t'; ++ptr);
    
    /* if line is blank, continue */
    if (*ptr == '\0')
        continue;
    
    /* see if name matches */
    if (strcasecmp (ptr, name) == 0){
        return 1;
        }
    }
    fclose (fp);
    return -1;
}

int
proxy_recv_krb5_credentials(int comm)
{
  krb5_error_code retval;
  krb5_auth_context auth_context = NULL;
  krb5_ticket *ticket;
  char *name;

  fprintf(stderr, "Initializing Kerberos ... "); fflush(stderr);
  if(proxy_krb5_init() != 0){
    return -1;
  }
  fprintf(stderr, "success\n"); fflush(stderr);

  fprintf(stderr, "Initializing Authentication Context ... "); fflush(stderr);
  retval = krb5_auth_con_init(proxy_krb5_info.context, &auth_context);
  if(retval){
    fprintf(stderr, "krb5_auth_con_init() failed: %s\n", error_message(retval));
    return -1;
  }
  fprintf(stderr, "success\n"); fflush(stderr);

  fprintf(stderr, "Receiving authentication info from client ... "); fflush(stderr);
  retval = krb5_recvauth (proxy_krb5_info.context, &auth_context,
              (krb5_pointer) &comm, gridsolve_version,
              proxy_krb5_info.server, 0, proxy_krb5_info.keytab, &ticket);
  if (retval) {
      fprintf (stderr, "Authentication failed: %s\n",
           error_message(retval)); fflush(stderr);
      return -1;
  }
  fprintf(stderr, "success\n"); fflush(stderr);
  
  krb5_unparse_name (proxy_krb5_info.context, ticket->enc_part2->client, &name);
  krb5_free_ticket (proxy_krb5_info.context, ticket);
  
  /* it's not enough to know that the ticket is valid;
     (i.e. that the client is who he says he is),
     we also need to check to see whether client has permission */

  fprintf(stderr, "Authenticated, checking if %s is authorized ... ", name); fflush(stderr);
  if (proxy_check_principal_name (name) < 0) {
      fprintf (stderr, "permission denied.\n"); fflush(stderr);
      return -1;
  }
  else{
    fprintf (stderr, "yes\n");
    fflush(stderr);
  }

  free (name);

  fprintf(stderr, "Freeing authentication context ... "); fflush(stderr);
  retval = krb5_auth_con_free(proxy_krb5_info.context, auth_context);
  if(retval){
    fprintf(stderr, "krb5_auth_con_free() failed: %s\n", error_message(retval));
    return -1;
  }
  fprintf(stderr, "success\n"); fflush(stderr);

  return 0;
}

int 
proxy_krb5_init()
{
  krb5_error_code retval;
  char * keytab_filename;
  retval = krb5_init_context (&(proxy_krb5_info.context));

  if (retval)
  {
    fprintf (stderr,
         "krb5_init_context failed: %s\n", error_message(retval));
    return -1;
  }

  proxy_krb5_info.keytab = NULL;   /* Maybe do something different later */
  keytab_filename = getenv ("GRIDSOLVE_KEYTAB");

  if (keytab_filename == NULL)
  {
    fprintf (stderr, "Environment variable GRIDSOLVE_KEYTAB not defined\n");
    return -1;
  }

  retval = krb5_kt_resolve (proxy_krb5_info.context, keytab_filename, &(proxy_krb5_info.keytab));
  if(retval){
    fprintf (stderr, "krb5_kt_resolve() failed: %s\n", error_message(retval));
    return -1;
  } 

  proxy_krb5_info.users_file = getenv("GRIDSOLVE_USERS");
  if (proxy_krb5_info.users_file == NULL)
  {
    fprintf (stderr, "Environment variable GRIDSOLVE_USERS not defined\n");
    return -1;
  }

  retval = krb5_sname_to_principal (proxy_krb5_info.context, NULL, "GridSolve",
                    KRB5_NT_SRV_HST, &(proxy_krb5_info.server));

  if (retval)
  {
    fprintf (stderr, "krb5_sname_to_principal() failed: %s\n",
         error_message (retval));
    return -1;
  }

  return 0;
}
  
#endif /* KERBEROS5 */