oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Merged in REVERSE1-branch.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@472 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Assar Westerlund
1996-05-04 04:27:23 +00:00
parent 3ee2585e1b
commit d2aa6baa26
4 changed files with 322 additions and 305 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
appl/kx/Makefile.in
View File

@@ -24,12 +24,13 @@ PROGS = $(PROG_BIN) $(PROG_LIBEXEC)
SOURCES_KX = kx.c
SOURCES_KXD = kxd.c
SOURCES_COMMON = common.c
OBJECTS_KX = kx.o
OBJECTS_KXD = kxd.o
OBJECTS_KX = kx.o common.o
OBJECTS_KXD = kxd.o common.o
OBJECTS = $(OBJECTS_KX) $(OBJECTS_KXD)
SOURCES = $(SOURCES_KX) $(SOURCES_KXD)
SOURCES = $(SOURCES_KX) $(SOURCES_KXD) $(SOURCES_COMMON)
all: $(PROGS)

421
appl/kx/kx.c
View File

@@ -2,253 +2,226 @@
RCSID("$Id$");
static char *prog;
char *prog;
static void
usage()
{
fprintf (stderr, "Usage: %s local-display-number host|display\n",
prog);
exit (1);
}
static int
doit_host (char *host, unsigned dnr, int fd)
{
CREDENTIALS cred;
KTEXT_ST text;
MSG_DAT msg;
int status;
des_key_schedule schedule;
struct sockaddr_in thisaddr, thataddr;
int addrlen;
void *ret;
struct hostent *hostent;
int s;
struct sockaddr_un unixaddr;
des_cblock iv1, iv2;
int num1 = 0, num2 = 0;
/*
* Establish authenticated connection
*/
hostent = gethostbyname (host);
if (hostent == NULL) {
fprintf (stderr, "%s: gethostbyname '%s' failed: ", prog, host);
return 1;
}
memset (&thataddr, 0, sizeof(thataddr));
thataddr.sin_family = AF_INET;
thataddr.sin_port = k_getportbyname ("kx", "tcp", htons(2111));
memcpy (&thataddr.sin_addr, hostent->h_addr, sizeof(thataddr.sin_addr));
s = socket (AF_INET, SOCK_STREAM, 0);
if (s < 0) {
fprintf (stderr, "%s: socket failed: %s\n", prog, k_strerror(errno));
return 1;
}
if (connect (s, (struct sockaddr *)&thataddr, sizeof(thataddr)) < 0) {
fprintf (stderr, "%s: connect(%s) failed: %s\n", prog, host,
k_strerror(errno));
return 1;
}
addrlen = sizeof(thisaddr);
if (getsockname (s, (struct sockaddr *)&thisaddr, &addrlen) < 0 ||
addrlen != sizeof(thisaddr)) {
fprintf (stderr, "%s: getsockname(%s) failed: %s\n",
prog, host, k_strerror(errno));
return 1;
}
status = krb_sendauth (KOPT_DO_MUTUAL, s, &text, "rcmd",
host, krb_realmofhost (host),
getpid(), &msg, &cred, schedule,
&thisaddr, &thataddr, "KXSERV.0");
if (status != KSUCCESS) {
fprintf (stderr, "%s: %s: %s\n", prog, host,
krb_get_err_text(status));
return 1;
}
/*
* Send parameters.
*/
{
u_char b = dnr;
char buf[128];
int ret;
if (write (s, &b, sizeof(b)) != sizeof(b)) {
fprintf (stderr, "%s: write: %s\n", prog, k_strerror (errno));
return 1;
}
if (read (s, &b, sizeof(b)) != sizeof(b)) {
fprintf (stderr, "%s: read: %s\n", prog, k_strerror (errno));
return 1;
}
if (b) {
fprintf (stderr, "%s: Error from '%s': ", prog, host);
ret = read (s, buf, sizeof(buf));
if(ret < 0) {
fprintf (stderr, "%s: read: %s\n", prog, k_strerror (errno));
return 1;
}
fprintf (stderr, "%s\n", buf);
return 1;
}
}
memcpy (&iv1, &cred.session, sizeof(iv1));
memcpy (&iv2, &cred.session, sizeof(iv2));
for (;;) {
fd_set fdset;
int ret;
char buf[BUFSIZ];
FD_ZERO(&fdset);
FD_SET(s, &fdset);
FD_SET(fd, &fdset);
ret = select (256, &fdset, NULL, NULL, NULL); /* XXX */
if (ret < 0 && errno != EINTR) {
fprintf (stderr, "%s: select: %s\n", prog, k_strerror (errno));
return 1;
}
if (FD_ISSET(s, &fdset)) {
ret = read (s, buf, sizeof(buf));
if (ret == 0)
return 0;
if (ret < 0) {
fprintf (stderr, "%s: read: %s\n", prog, k_strerror (errno));
return 1;
}
#ifndef NOENCRYPTION
des_cfb64_encrypt (buf, buf, ret, schedule, &iv1,
&num1, DES_DECRYPT);
#endif
ret = krb_net_write (fd, buf, ret);
if (ret < 0) {
fprintf (stderr, "%s: write: %s\n", prog, k_strerror (errno));
return 1;
}
}
if (FD_ISSET(fd, &fdset)) {
ret = read (fd, buf, sizeof(buf));
if (ret == 0)
return 0;
if (ret < 0) {
fprintf (stderr, "%s: read: %s\n", prog, k_strerror (errno));
return 1;
}
#ifndef NOENCRYPTION
des_cfb64_encrypt (buf, buf, ret, schedule, &iv2,
&num2, DES_ENCRYPT);
#endif
ret = krb_net_write (s, buf, ret);
if (ret < 0) {
fprintf (stderr, "%s: write: %s\n", prog, k_strerror (errno));
return 1;
}
}
}
fprintf (stderr, "Usage: %s host\n",
prog);
exit (1);
}
/*
* Listen for calls to the remote X-server.
* Establish authenticated connection
*/
static int
doit (unsigned localnr, char *host, unsigned remotenr)
connect_host (char *host, des_cblock *key, des_key_schedule schedule)
{
int fd;
struct sockaddr_un addr;
int dnr;
CREDENTIALS cred;
KTEXT_ST text;
MSG_DAT msg;
int status;
struct sockaddr_in thisaddr, thataddr;
int addrlen;
struct hostent *hostent;
int s;
u_char b;
fd = socket (AF_UNIX, SOCK_STREAM, 0);
if (fd < 0) {
fprintf (stderr, "%s: socket failed: %s\n", prog, k_strerror(errno));
return 1;
}
addr.sun_family = AF_UNIX;
sprintf (addr.sun_path, "/tmp/.X11-unix/X%u", localnr);
unlink (addr.sun_path);
if(bind (fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
fprintf (stderr, "%s: bind failed: %s\n", prog,
k_strerror(errno));
return 1;
}
if (listen (fd, 5) < 0) {
fprintf (stderr, "%s: listen failed: %s\n", prog,
k_strerror(errno));
return 1;
}
for (;;) {
int newfd;
struct sockaddr_un that;
int len;
pid_t pid;
hostent = gethostbyname (host);
if (hostent == NULL) {
fprintf (stderr, "%s: gethostbyname '%s' failed: ", prog, host);
return -1;
}
len = sizeof (that);
newfd = accept (fd, (struct sockaddr *)&that, &len);
if (newfd < 0)
if (errno == EINTR)
continue;
else {
fprintf (stderr, "%s: accept: %s\n", prog, k_strerror (errno));
return 1;
}
fprintf (stderr, "%s: New connection\n", prog);
pid = fork ();
if (pid < 0) {
fprintf (stderr, "%s: fork: %s\n", prog, k_strerror (errno));
return 1;
} else if (pid == 0) {
close (fd);
return doit_host (host, remotenr, newfd);
} else {
close (newfd);
}
}
memset (&thataddr, 0, sizeof(thataddr));
thataddr.sin_family = AF_INET;
thataddr.sin_port = k_getportbyname ("kx", "tcp", htons(2111));
memcpy (&thataddr.sin_addr, hostent->h_addr, sizeof(thataddr.sin_addr));
s = socket (AF_INET, SOCK_STREAM, 0);
if (s < 0) {
fprintf (stderr, "%s: socket failed: %s\n", prog, k_strerror(errno));
return -1;
}
if (connect (s, (struct sockaddr *)&thataddr, sizeof(thataddr)) < 0) {
fprintf (stderr, "%s: connect(%s) failed: %s\n", prog, host,
k_strerror(errno));
return -1;
}
addrlen = sizeof(thisaddr);
if (getsockname (s, (struct sockaddr *)&thisaddr, &addrlen) < 0 ||
addrlen != sizeof(thisaddr)) {
fprintf (stderr, "%s: getsockname(%s) failed: %s\n",
prog, host, k_strerror(errno));
return -1;
}
status = krb_sendauth (KOPT_DO_MUTUAL, s, &text, "rcmd",
host, krb_realmofhost (host),
getpid(), &msg, &cred, schedule,
&thisaddr, &thataddr, "KXSERV.0");
if (status != KSUCCESS) {
fprintf (stderr, "%s: %s: %s\n", prog, host,
krb_get_err_text(status));
return -1;
}
if (read (s, &b, sizeof(b)) != sizeof(b)) {
fprintf (stderr, "%s: read: %s\n", prog,
k_strerror(errno));
return -1;
}
if (b) {
char buf[BUFSIZ];
read (s, buf, sizeof(buf));
buf[BUFSIZ - 1] = '\0';
fprintf (stderr, "%s: %s: %s\n", prog, host, buf);
return -1;
}
memcpy(key, &cred.session, sizeof(des_cblock));
return s;
}
static
RETSIGTYPE
childhandler ()
static int
active (int fd, char *host, des_cblock *iv, des_key_schedule schedule)
{
pid_t pid;
int status;
int kxd;
u_char zero = 0;
do {
pid = waitpid (-1, &status, WNOHANG|WUNTRACED);
} while(pid > 0);
signal (SIGCHLD, childhandler);
kxd = connect_host (host, iv, schedule);
if (kxd < 0)
return 1;
if (write (kxd, &zero, sizeof(zero)) != sizeof(zero)) {
fprintf (stderr, "%s: write: %s\n", prog,
k_strerror(errno));
return 1;
}
return copy_encrypted (fd, kxd, iv, schedule);
}
static int
passive (int fd, char *host, des_cblock *iv, des_key_schedule schedule)
{
int xserver;
xserver = connect_local_xsocket (0);
if (xserver < 0)
return 1;
return copy_encrypted (xserver, fd, iv, schedule);
}
/*
* fx - forward x connection.
* Connect to the given host.
* Iff passivep, give it a port number to call you back and then wait.
* Else, listen on a local display and then connect to the remote host
* when a local client gets connected.
*/
static int
doit (char *host, int passivep)
{
int otherside;
des_key_schedule schedule;
des_cblock key;
int rendez_vous;
int (*fn)(int fd, char *host, des_cblock *iv,
des_key_schedule schedule);
if (passivep) {
struct sockaddr_in newaddr;
int addrlen;
u_char b = passivep;
int otherside;
otherside = connect_host (host, &key, schedule);
if (otherside < 0)
return 1;
rendez_vous = socket (AF_INET, SOCK_STREAM, 0);
if (rendez_vous < 0) {
fprintf (stderr, "%s: socket failed: %s\n", prog,
k_strerror(errno));
return 1;
}
memset (&newaddr, 0, sizeof(newaddr));
if (bind (rendez_vous, (struct sockaddr *)&newaddr,
sizeof(newaddr)) < 0) {
fprintf (stderr, "%s: bind: %s\n", prog, k_strerror(errno));
return 1;
}
addrlen = sizeof(newaddr);
if (getsockname (rendez_vous, (struct sockaddr *)&newaddr,
&addrlen) < 0) {
fprintf (stderr, "%s: getsockname: %s\n", prog,
k_strerror(errno));
return 1;
}
if (listen (rendez_vous, SOMAXCONN) < 0) {
fprintf (stderr, "%s: listen: %s\n", prog, k_strerror(errno));
return 1;
}
if (write (otherside, &b, sizeof(b)) != sizeof(b) ||
write (otherside, &newaddr.sin_port, sizeof(newaddr.sin_port))
!= sizeof(newaddr.sin_port)) {
fprintf (stderr, "%s: write: %s\n", prog, k_strerror(errno));
return 1;
}
close (otherside);
fn = passive;
} else {
rendez_vous = get_local_xsocket (1); /* XXX */
if (rendez_vous < 0)
return 1;
fn = active;
}
for (;;) {
pid_t child;
int fd;
int zero = 0;
fd = accept (rendez_vous, NULL, &zero);
if (fd < 0)
if (errno == EINTR)
continue;
else {
fprintf (stderr, "%s: accept: %s\n", prog,
k_strerror(errno));
return 1;
}
child = fork ();
if (child < 0) {
fprintf (stderr, "%s: fork: %s\n", prog,
k_strerror(errno));
continue;
} else if (child == 0) {
close (rendez_vous);
return (*fn)(fd, host, &key, schedule);
} else {
close (fd);
}
}
}
/*
* kx - forward x connection over a kerberos-encrypted channel.
*
* passive mode if $DISPLAY begins with :
*/
int
main(argc, argv)
int argc;
char **argv;
main(int argc, char **argv)
{
int dnr;
char *p;
int passivep;
char *disp;
prog = argv[0];
if (argc != 3)
usage ();
p = strchr (argv[2], ':');
if (p) {
*p = '\0';
dnr = atoi (p+1);
} else
dnr = 0;
signal (SIGCHLD, childhandler);
return doit (atoi(argv[1]), argv[2], dnr);
prog = argv[0];
if (argc != 2)
usage ();
disp = getenv("DISPLAY");
passivep = disp != NULL && *disp == ':';
signal (SIGCHLD, childhandler);
return doit (argv[1], passivep);
}

18
appl/kx/kx.h
View File

@@ -24,3 +24,21 @@
#include <sys/un.h>
#include <krb.h>
#ifndef max
#define max(a,b) (((a)>(b))?(a):(b))
#endif
#ifndef SOMAXCONN
#define SOMAXCONN 5
#endif
extern char *prog;
int copy_encrypted (int fd1, int fd2, des_cblock *iv,
des_key_schedule schedule);
RETSIGTYPE childhandler ();
int get_local_xsocket (unsigned dnr);
int connect_local_xsocket (unsigned dnr);

181
appl/kx/kxd.c
View File

@@ -4,6 +4,8 @@ RCSID("$Id$");
#include <syslog.h>
char *prog;
static int
fatal (int fd, char *s)
{
@@ -16,27 +18,19 @@ fatal (int fd, char *s)
}
static int
doit(int sock)
recv_conn (int sock, des_cblock *key, des_key_schedule schedule,
struct sockaddr_in *retaddr)
{
int status;
KTEXT_ST ticket;
AUTH_DAT auth;
char instance[INST_SZ + 1];
des_key_schedule schedule;
struct sockaddr_in thisaddr, thataddr;
int addrlen;
int len;
char buf[BUFSIZ];
void *data;
struct passwd *passwd;
char version[KRB_SENDAUTH_VLEN];
int fd;
struct stat sb;
struct sockaddr_un addr;
char *username;
des_cblock iv1, iv2;
int num1 = 0, num2 = 0;
unsigned dnr;
u_char ok = 0;
struct passwd *passwd;
addrlen = sizeof(thisaddr);
if (getsockname (sock, (struct sockaddr *)&thisaddr, &addrlen) < 0 ||
@@ -57,17 +51,7 @@ doit(int sock)
strncmp(version, "KXSERV.0", KRB_SENDAUTH_VLEN) != 0) {
return 1;
}
{
u_char b;
if (read (sock, &b, sizeof(b)) != sizeof(b))
return 1;
dnr = b;
}
if (stat ("/dev/console", &sb) < 0)
return fatal (sock, "Cannot stat /dev/console");
passwd = getpwuid (sb.st_uid);
passwd = getpwnam (auth.pname);
if (passwd == NULL)
return fatal (sock, "Cannot find uid");
username = strdup (passwd->pw_name);
@@ -79,65 +63,103 @@ doit(int sock)
setuid(passwd->pw_uid)) {
return fatal (sock, "Cannot set uid");
}
fd = socket (AF_UNIX, SOCK_STREAM, 0);
if (fd < 0)
return fatal (sock, "Cannot create socket");
addr.sun_family = AF_UNIX;
sprintf (addr.sun_path, "/tmp/.X11-unix/X%u", dnr);
if (connect (fd, (struct sockaddr *)&addr, sizeof(addr)) < 0)
{
char msg[200];
sprintf (msg, "Cannot connect to %s", addr.sun_path);
return fatal (sock, msg);
}
memcpy (&iv1, &auth.session, sizeof(iv1));
memcpy (&iv2, &auth.session, sizeof(iv2));
{
u_char b = 0;
if (write (sock, &ok, sizeof(ok)) != sizeof(ok))
return 1;
if (write (sock, &b, sizeof(b)) != sizeof(b))
return 1;
}
for (;;) {
fd_set fdset;
int ret;
char buf[BUFSIZ];
memcpy(key, &auth.session, sizeof(des_cblock));
*retaddr = thataddr;
return 0;
}
FD_ZERO(&fdset);
FD_SET(sock, &fdset);
FD_SET(fd, &fdset);
static int
doit_conn (int fd, struct sockaddr_in *thataddr,
des_cblock *key, des_key_schedule schedule)
{
int sock;
ret = select (fd+1, &fdset, NULL, NULL, NULL);
if (ret < 0 && errno != EINTR)
sock = socket (AF_INET, SOCK_STREAM, 0);
if (sock < 0) {
char msg[200];
sprintf (msg, "socket: %s", k_strerror(errno));
return fatal (sock, msg);
}
if (connect (sock, (struct sockaddr *)thataddr,
sizeof(*thataddr)) < 0) {
abort ();
}
return copy_encrypted (fd, sock, key, schedule);
}
/*
*
*/
static int
check_user_console ()
{
struct stat sb;
if (stat ("/dev/console", &sb) < 0)
return fatal (0, "Cannot stat /dev/console");
if (getuid() != sb.st_uid)
return fatal (0, "Permission denied");
return 0;
}
static int
doit(int sock)
{
u_char passivep;
struct sockaddr_in thataddr;
des_key_schedule schedule;
des_cblock key;
int localx;
if (recv_conn (sock, &key, schedule, &thataddr))
return 1;
if (read (sock, &passivep, sizeof(passivep)) != sizeof(passivep))
return 1;
if (passivep) {
if (read (sock, &thataddr.sin_port, sizeof(thataddr.sin_port))
!= sizeof(thataddr.sin_port))
return 1;
if (FD_ISSET(sock, &fdset)) {
ret = read (sock, buf, sizeof(buf));
if (ret == 0)
return 0;
if (ret < 0)
return 1;
#ifndef NOENCRYPTION
des_cfb64_encrypt (buf, buf, ret, schedule,
&iv1, &num1, DES_DECRYPT);
#endif
ret = krb_net_write (fd, buf, ret);
if (ret < 0)
return 1;
}
if (FD_ISSET(fd, &fdset)) {
ret = read (fd, buf, sizeof(buf));
if (ret == 0)
return 0;
if (ret < 0)
return 1;
#ifndef NOENCRYPTION
des_cfb64_encrypt (buf, buf, ret, schedule,
&iv2, &num2, DES_ENCRYPT);
#endif
ret = krb_net_write (STDOUT_FILENO, buf, ret);
if (ret < 0)
return 1;
localx = get_local_xsocket (1);
if (localx < 0)
return 1;
for (;;) {
pid_t child;
int fd;
int zero = 0;
fd = accept (localx, NULL, &zero);
if (fd < 0)
if (errno == EINTR)
continue;
else {
char msg[200];
sprintf (msg, "accept: %s\n", k_strerror (errno));
return fatal (sock, msg);
}
child = fork ();
if (child < 0) {
char msg[200];
sprintf (msg, "fork: %s\n", k_strerror (errno));
return fatal(sock, msg);
} else if (child == 0) {
close (localx);
return doit_conn (fd, &thataddr, &key, schedule);
} else {
close (fd);
}
}
} else {
if (check_user_console ())
return 1;
localx = connect_local_xsocket (0);
if (localx < 0)
return 1;
return copy_encrypted (localx, sock, &key, schedule);
}
}
@@ -148,6 +170,9 @@ doit(int sock)
int
main (int argc, char **argv)
{
openlog(argv[0], LOG_PID|LOG_CONS, LOG_DAEMON);
prog = argv[0];
openlog(prog, LOG_PID|LOG_CONS, LOG_DAEMON);
signal (SIGCHLD, childhandler);
return doit(0);
}