new file
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@2423 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Assar Westerlund
260
kpasswd/kpasswdd.c
Normal file
260
kpasswd/kpasswdd.c
Normal file
@@ -0,0 +1,260 @@
|
||||
/*
|
||||
* Copyright (c) 1997 Kungliga Tekniska H<>gskolan
|
||||
* (Royal Institute of Technology, Stockholm, Sweden).
|
||||
* All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
*
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
*
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
*
|
||||
* 3. All advertising materials mentioning features or use of this software
|
||||
* must display the following acknowledgement:
|
||||
* This product includes software developed by Kungliga Tekniska
|
||||
* H<>gskolan and its contributors.
|
||||
*
|
||||
* 4. Neither the name of the Institute nor the names of its contributors
|
||||
* may be used to endorse or promote products derived from this software
|
||||
* without specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
|
||||
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
#include "kpasswd_locl.h"
|
||||
#include <hdb.h>
|
||||
RCSID("$Id$");
|
||||
|
||||
static void
|
||||
syslog_and_die (const char *m, ...)
|
||||
{
|
||||
va_list args;
|
||||
|
||||
va_start(args, m);
|
||||
vsyslog (LOG_ERR, m, args);
|
||||
va_end(args);
|
||||
exit (1);
|
||||
}
|
||||
|
||||
static char *database = HDB_DEFAULT_DB;
|
||||
|
||||
static void
|
||||
change (krb5_context context,
|
||||
krb5_principal principal,
|
||||
krb5_data *pwd_data)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
char *c;
|
||||
HDB *db;
|
||||
hdb_entry ent;
|
||||
krb5_data salt;
|
||||
|
||||
krb5_unparse_name (context, principal, &c);
|
||||
|
||||
syslog (LOG_INFO, "Changing password for %s", c);
|
||||
free (c);
|
||||
|
||||
ret = hdb_open (context, &db, database, O_RDWR, 0600);
|
||||
if (ret) {
|
||||
syslog (LOG_ERR, "hdb_open: %s", krb5_get_err_text(context, ret));
|
||||
return;
|
||||
}
|
||||
|
||||
ent.principal = principal;
|
||||
|
||||
ret = db->fetch (context, db, &ent);
|
||||
|
||||
switch (ret) {
|
||||
case KRB5_HDB_NOENTRY:
|
||||
syslog (LOG_ERR, "not found in database");
|
||||
return;
|
||||
case 0:
|
||||
break;
|
||||
default :
|
||||
syslog (LOG_ERR, "dbfetch: %s", krb5_get_err_text(context, ret));
|
||||
return;
|
||||
}
|
||||
|
||||
krb5_data_zero (&salt);
|
||||
krb5_get_salt (principal, &salt);
|
||||
memset (&ent.keyblock, 0, sizeof(ent.keyblock));
|
||||
{
|
||||
char *pwd;
|
||||
|
||||
pwd = malloc (pwd_data->length + 1);
|
||||
strcpy (pwd, pwd_data->data);
|
||||
pwd[pwd_data->length] = '\0';
|
||||
krb5_string_to_key (pwd, &salt, &ent.keyblock);
|
||||
free (pwd);
|
||||
}
|
||||
krb5_data_free (&salt);
|
||||
ent.kvno++;
|
||||
ent.last_change = time(NULL);
|
||||
krb5_copy_principal (context, principal, &ent.changed_by);
|
||||
ret = db->store (context, db, &ent);
|
||||
if (ret == -1) {
|
||||
syslog (LOG_ERR, "dbstore: %m");
|
||||
return;
|
||||
}
|
||||
hdb_free_entry (context, &ent);
|
||||
db->close (context, db);
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
process (krb5_context context,
|
||||
krb5_principal server,
|
||||
int s,
|
||||
struct sockaddr_in *addr,
|
||||
u_char *msg,
|
||||
int len)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
krb5_auth_context auth_context = NULL;
|
||||
u_int16_t pkt_len, pkt_ver, ap_req_len;
|
||||
|
||||
krb5_data ap_req_data;
|
||||
krb5_data krb_priv_data;
|
||||
krb5_data out_data;
|
||||
krb5_ticket *ticket;
|
||||
|
||||
pkt_len = (msg[0] << 8) | (msg[1]);
|
||||
pkt_ver = (msg[2] << 8) | (msg[3]);
|
||||
ap_req_len = (msg[4] << 8) | (msg[5]);
|
||||
if (pkt_len != len) {
|
||||
syslog (LOG_ERR, "Strange len: %d != %d", pkt_len, len);
|
||||
return;
|
||||
}
|
||||
if (pkt_ver != 0x0001) {
|
||||
syslog (LOG_ERR, "Bad version (%d)", pkt_ver);
|
||||
return;
|
||||
}
|
||||
|
||||
ap_req_data.data = msg + 6;
|
||||
ap_req_data.length = ap_req_len;
|
||||
|
||||
ret = krb5_rd_req (context,
|
||||
&auth_context,
|
||||
&ap_req_data,
|
||||
server,
|
||||
NULL,
|
||||
NULL,
|
||||
&ticket);
|
||||
if (ret) {
|
||||
syslog (LOG_ERR, "krb5_rd_req: %s",
|
||||
krb5_get_err_text(context, ret));
|
||||
return;
|
||||
}
|
||||
|
||||
if (!ticket->ticket.flags.initial) {
|
||||
syslog (LOG_ERR, "initial flag not set");
|
||||
return;
|
||||
}
|
||||
krb_priv_data.data = msg + 6 + ap_req_len;
|
||||
krb_priv_data.length = len - 6 - ap_req_len;
|
||||
|
||||
krb5_data_zero (&out_data);
|
||||
|
||||
ret = krb5_rd_priv (context,
|
||||
auth_context,
|
||||
&krb_priv_data,
|
||||
&out_data,
|
||||
NULL);
|
||||
|
||||
if (ret) {
|
||||
syslog (LOG_ERR, "krb5_rd_priv: %s",
|
||||
krb5_get_err_text(context, ret));
|
||||
return;
|
||||
}
|
||||
|
||||
change (context, ticket->client, &out_data);
|
||||
|
||||
krb5_auth_con_free (context, auth_context);
|
||||
}
|
||||
|
||||
static void
|
||||
doit (int port)
|
||||
{
|
||||
krb5_error_code ret;
|
||||
krb5_context context;
|
||||
krb5_principal server;
|
||||
struct sockaddr_in addr;
|
||||
int s;
|
||||
char *realm;
|
||||
|
||||
ret = krb5_init_context (&context);
|
||||
if (ret)
|
||||
syslog_and_die ("krb5_init_context: %s",
|
||||
krb5_get_err_text(context, ret));
|
||||
|
||||
ret = krb5_get_default_realm (context, &realm);
|
||||
if (ret)
|
||||
syslog_and_die ("krb5_get_default_realm: %s",
|
||||
krb5_get_err_text(context, ret));
|
||||
|
||||
ret = krb5_build_principal_ext (context,
|
||||
&server,
|
||||
strlen(realm),
|
||||
realm,
|
||||
strlen("kadmin"),
|
||||
"kadmin",
|
||||
strlen("changepw"),
|
||||
"changepw",
|
||||
NULL);
|
||||
if (ret)
|
||||
syslog_and_die ("krb5_build_principal_ext: %s",
|
||||
krb5_get_err_text(context, ret));
|
||||
|
||||
free (realm);
|
||||
|
||||
s = socket (AF_INET, SOCK_DGRAM, 0);
|
||||
if (s < 0)
|
||||
syslog_and_die ("socket: %m");
|
||||
memset (&addr, 0, sizeof(addr));
|
||||
addr.sin_family = AF_INET;
|
||||
addr.sin_addr.s_addr = INADDR_ANY;
|
||||
addr.sin_port = port;
|
||||
if (bind (s, (struct sockaddr *)&addr, sizeof(addr)) < 0)
|
||||
syslog_and_die ("bind: %m");
|
||||
for (;;) {
|
||||
struct sockaddr_in other_addr;
|
||||
u_char buf[BUFSIZ];
|
||||
int ret;
|
||||
int addrlen = sizeof(other_addr);
|
||||
|
||||
ret = recvfrom (s, buf, sizeof(buf), 0,
|
||||
(struct sockaddr *)&other_addr,
|
||||
&addrlen);
|
||||
if (ret < 0)
|
||||
if(errno == EINTR)
|
||||
continue;
|
||||
else
|
||||
syslog_and_die ("recvfrom: %m");
|
||||
process (context, server, s, &other_addr, buf, ret);
|
||||
}
|
||||
}
|
||||
|
||||
int
|
||||
main (int argc, char **argv)
|
||||
{
|
||||
set_progname (argv[0]);
|
||||
openlog ("kpasswdd", LOG_ODELAY | LOG_PID, LOG_AUTH);
|
||||
|
||||
doit (krb5_getportbyname ("kpasswd", "udp", htons(KPASSWD_PORT)));
|
||||
return 0;
|
||||
}
|
||||
Reference in New Issue
Block a user