kerberos5.c revision 1.12
1 /* $NetBSD: kerberos5.c,v 1.12 2003/08/07 16:44:55 agc Exp $ */ 2 3 /*- 4 * Copyright (c) 1991, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * Copyright (C) 1990 by the Massachusetts Institute of Technology 34 * 35 * Export of this software from the United States of America may 36 * require a specific license from the United States Government. 37 * It is the responsibility of any person or organization contemplating 38 * export to obtain such a license before exporting. 39 * 40 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 41 * distribute this software and its documentation for any purpose and 42 * without fee is hereby granted, provided that the above copyright 43 * notice appear in all copies and that both that copyright notice and 44 * this permission notice appear in supporting documentation, and that 45 * the name of M.I.T. not be used in advertising or publicity pertaining 46 * to distribution of the software without specific, written prior 47 * permission. M.I.T. makes no representations about the suitability of 48 * this software for any purpose. It is provided "as is" without express 49 * or implied warranty. 50 */ 51 52 #ifdef KRB5 53 #include <arpa/telnet.h> 54 #include <stdio.h> 55 #include <stdlib.h> 56 #include <string.h> 57 #include <unistd.h> 58 #include <netdb.h> 59 #include <ctype.h> 60 #include <pwd.h> 61 #define Authenticator k5_Authenticator 62 #include <krb5.h> 63 #undef Authenticator 64 /* #include <roken.h> */ 65 66 #include "encrypt.h" 67 #include "auth.h" 68 #include "misc.h" 69 70 extern int net; 71 72 int forward_flags; /* Flags get set in telnet/main.c on -f and -F */ 73 int got_forwarded_creds;/* Tell telnetd to pass -F or -f to login. */ 74 75 int require_hwpreauth; 76 77 void kerberos5_forward(Authenticator *); 78 79 static unsigned char str_data[1024] = {IAC, SB, TELOPT_AUTHENTICATION, 0, 80 AUTHTYPE_KERBEROS_V5,}; 81 82 #define KRB_AUTH 0 /* Authentication data follows */ 83 #define KRB_REJECT 1 /* Rejected (reason might follow) */ 84 #define KRB_ACCEPT 2 /* Accepted */ 85 #define KRB_RESPONSE 3 /* Response for mutual auth. */ 86 87 #define KRB_FORWARD 4 /* Forwarded credentials follow */ 88 #define KRB_FORWARD_ACCEPT 5 /* Forwarded credentials accepted */ 89 #define KRB_FORWARD_REJECT 6 /* Forwarded credentials rejected */ 90 91 static krb5_data auth; 92 static krb5_ticket *ticket; 93 94 krb5_context telnet_context; 95 static krb5_auth_context auth_context; 96 97 static int 98 Data(Authenticator *ap, int type, void *d, int c) 99 { 100 unsigned char *p = str_data + 4; 101 unsigned char *cd = (unsigned char *) d; 102 103 if (c == -1) 104 c = strlen(cd); 105 106 if (auth_debug_mode) { 107 printf("%s:%d: [%d] (%d)", 108 str_data[3] == TELQUAL_IS ? ">>>IS" : ">>>REPLY", 109 str_data[3], 110 type, c); 111 printd(d, c); 112 printf("\r\n"); 113 } 114 *p++ = ap->type; 115 *p++ = ap->way; 116 *p++ = type; 117 while (c-- > 0) { 118 if ((*p++ = *cd++) == IAC) 119 *p++ = IAC; 120 } 121 *p++ = IAC; 122 *p++ = SE; 123 if (str_data[3] == TELQUAL_IS) 124 printsub('>', &str_data[2], p - &str_data[2]); 125 return (telnet_net_write(str_data, p - str_data)); 126 } 127 128 int 129 kerberos5_init(Authenticator *ap, int server) 130 { 131 krb5_error_code ret; 132 133 if (telnet_context == 0) { 134 ret = krb5_init_context(&telnet_context); 135 if (ret) 136 return 0; 137 } 138 139 if (server) { 140 krb5_keytab kt; 141 krb5_kt_cursor cursor; 142 143 ret = krb5_kt_default(telnet_context, &kt); 144 if (ret) 145 return 0; 146 147 ret = krb5_kt_start_seq_get(telnet_context, kt, &cursor); 148 if (ret) { 149 krb5_kt_close(telnet_context, kt); 150 return 0; 151 } 152 krb5_kt_end_seq_get(telnet_context, kt, &cursor); 153 krb5_kt_close(telnet_context, kt); 154 155 str_data[3] = TELQUAL_REPLY; 156 } else 157 str_data[3] = TELQUAL_IS; 158 return (1); 159 } 160 161 int 162 kerberos5_send(Authenticator *ap) 163 { 164 krb5_error_code ret; 165 krb5_ccache ccache; 166 int ap_opts; 167 krb5_data cksum_data; 168 char foo[2]; 169 170 printf("[ Trying KERBEROS5 ... ]\r\n"); 171 172 if (!UserNameRequested) { 173 if (auth_debug_mode) { 174 printf("Kerberos V5: no user name supplied\r\n"); 175 } 176 return (0); 177 } 178 ret = krb5_cc_default(telnet_context, &ccache); 179 if (ret) { 180 if (auth_debug_mode) { 181 printf( 182 "Kerberos V5: could not get default ccache: %s\r\n", 183 krb5_get_err_text(telnet_context, ret)); 184 } 185 return (0); 186 } 187 if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) 188 ap_opts = AP_OPTS_MUTUAL_REQUIRED; 189 else 190 ap_opts = 0; 191 192 ap_opts |= AP_OPTS_USE_SUBKEY; 193 194 ret = krb5_auth_con_init(telnet_context, &auth_context); 195 if (ret) { 196 if (auth_debug_mode) { 197 printf( 198 "Kerberos V5: krb5_auth_con_init failed: %s\r\n", 199 krb5_get_err_text(telnet_context, ret)); 200 } 201 return (0); 202 } 203 ret = krb5_auth_con_setaddrs_from_fd(telnet_context, 204 auth_context, &net); 205 if (ret) { 206 if (auth_debug_mode) { 207 printf("Kerberos V5: " 208 "krb5_auth_con_setaddrs_from_fd failed: %s\r\n", 209 krb5_get_err_text(telnet_context, ret)); 210 } 211 return (0); 212 } 213 krb5_auth_con_setkeytype(telnet_context, auth_context, KEYTYPE_DES); 214 215 foo[0] = ap->type; 216 foo[1] = ap->way; 217 218 cksum_data.length = sizeof(foo); 219 cksum_data.data = foo; 220 ret = krb5_mk_req(telnet_context, &auth_context, ap_opts, "host", 221 RemoteHostName, &cksum_data, ccache, &auth); 222 if (ret) { 223 if (1 || auth_debug_mode) { 224 printf("Kerberos V5: mk_req failed (%s)\r\n", 225 krb5_get_err_text(telnet_context, ret)); 226 } 227 return (0); 228 } 229 230 if (!auth_sendname((unsigned char *) UserNameRequested, 231 strlen(UserNameRequested))) { 232 if (auth_debug_mode) 233 printf("Not enough room for user name\r\n"); 234 return (0); 235 } 236 if (!Data(ap, KRB_AUTH, auth.data, auth.length)) { 237 if (auth_debug_mode) 238 printf("Not enough room for authentication data\r\n"); 239 return (0); 240 } 241 if (auth_debug_mode) { 242 printf("Sent Kerberos V5 credentials to server\r\n"); 243 } 244 return (1); 245 } 246 247 void 248 kerberos5_is(Authenticator * ap, unsigned char *data, int cnt) 249 { 250 krb5_error_code ret; 251 krb5_data outbuf; 252 krb5_keyblock *key_block; 253 char *name; 254 krb5_principal server; 255 int zero = 0; 256 257 if (cnt-- < 1) 258 return; 259 switch (*data++) { 260 case KRB_AUTH: 261 auth.data = (char *) data; 262 auth.length = cnt; 263 264 auth_context = NULL; 265 266 ret = krb5_auth_con_init(telnet_context, &auth_context); 267 if (ret) { 268 Data(ap, KRB_REJECT, "krb5_auth_con_init failed", -1); 269 auth_finished(ap, AUTH_REJECT); 270 if (auth_debug_mode) 271 printf("Kerberos V5: krb5_auth_con_init failed (%s)\r\n", 272 krb5_get_err_text(telnet_context, ret)); 273 return; 274 } 275 ret = krb5_auth_con_setaddrs_from_fd(telnet_context, 276 auth_context, &zero); 277 if (ret) { 278 Data(ap, KRB_REJECT, "krb5_auth_con_setaddrs_from_fd failed", -1); 279 auth_finished(ap, AUTH_REJECT); 280 if (auth_debug_mode) 281 printf("Kerberos V5: " 282 "krb5_auth_con_setaddrs_from_fd failed (%s)\r\n", 283 krb5_get_err_text(telnet_context, ret)); 284 return; 285 } 286 ret = krb5_sock_to_principal(telnet_context, 0, "host", 287 KRB5_NT_SRV_HST, &server); 288 if (ret) { 289 Data(ap, KRB_REJECT, "krb5_sock_to_principal failed", -1); 290 auth_finished(ap, AUTH_REJECT); 291 if (auth_debug_mode) 292 printf("Kerberos V5: " 293 "krb5_sock_to_principal failed (%s)\r\n", 294 krb5_get_err_text(telnet_context, ret)); 295 return; 296 } 297 ret = krb5_rd_req(telnet_context, &auth_context, &auth, 298 server, NULL, NULL, &ticket); 299 krb5_free_principal(telnet_context, server); 300 301 if (ret) { 302 char *errbuf; 303 304 asprintf(&errbuf, 305 "Read req failed: %s", 306 krb5_get_err_text(telnet_context, ret)); 307 Data(ap, KRB_REJECT, errbuf, -1); 308 if (auth_debug_mode) 309 printf("%s\r\n", errbuf); 310 free(errbuf); 311 return; 312 } { 313 char foo[2]; 314 315 foo[0] = ap->type; 316 foo[1] = ap->way; 317 318 ret = krb5_verify_authenticator_checksum(telnet_context, 319 auth_context, foo, sizeof(foo)); 320 321 if (ret) { 322 char *errbuf; 323 asprintf(&errbuf, "Bad checksum: %s", 324 krb5_get_err_text(telnet_context, ret)); 325 Data(ap, KRB_REJECT, errbuf, -1); 326 if (auth_debug_mode) 327 printf("%s\r\n", errbuf); 328 free(errbuf); 329 return; 330 } 331 } 332 ret = krb5_auth_con_getremotesubkey(telnet_context, 333 auth_context, &key_block); 334 335 if (ret) { 336 Data(ap, KRB_REJECT, "krb5_auth_con_getremotesubkey failed", -1); 337 auth_finished(ap, AUTH_REJECT); 338 if (auth_debug_mode) 339 printf("Kerberos V5: " 340 "krb5_auth_con_getremotesubkey failed (%s)\r\n", 341 krb5_get_err_text(telnet_context, ret)); 342 return; 343 } 344 if (key_block == NULL) { 345 ret = krb5_auth_con_getkey(telnet_context, 346 auth_context, 347 &key_block); 348 } 349 if (ret) { 350 Data(ap, KRB_REJECT, "krb5_auth_con_getkey failed", -1); 351 auth_finished(ap, AUTH_REJECT); 352 if (auth_debug_mode) 353 printf("Kerberos V5: " 354 "krb5_auth_con_getkey failed (%s)\r\n", 355 krb5_get_err_text(telnet_context, ret)); 356 return; 357 } 358 if (key_block == NULL) { 359 Data(ap, KRB_REJECT, "no subkey received", -1); 360 auth_finished(ap, AUTH_REJECT); 361 if (auth_debug_mode) 362 printf("Kerberos V5: " 363 "krb5_auth_con_getremotesubkey returned NULL key\r\n"); 364 return; 365 } 366 if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) { 367 ret = krb5_mk_rep(telnet_context, 368 auth_context, &outbuf); 369 if (ret) { 370 Data(ap, KRB_REJECT, 371 "krb5_mk_rep failed", -1); 372 auth_finished(ap, AUTH_REJECT); 373 if (auth_debug_mode) 374 printf("Kerberos V5: " 375 "krb5_mk_rep failed (%s)\r\n", 376 krb5_get_err_text(telnet_context, 377 ret)); 378 return; 379 } 380 Data(ap, KRB_RESPONSE, outbuf.data, outbuf.length); 381 } 382 if (krb5_unparse_name(telnet_context, ticket->client, &name)) 383 name = 0; 384 385 if (UserNameRequested && krb5_kuserok(telnet_context, 386 ticket->client, UserNameRequested)) { 387 Data(ap, KRB_ACCEPT, name, name ? -1 : 0); 388 if (auth_debug_mode) { 389 printf("Kerberos5 identifies him as ``%s''\r\n", 390 name ? name : ""); 391 } 392 if (key_block->keytype == ETYPE_DES_CBC_MD5 || 393 key_block->keytype == ETYPE_DES_CBC_MD4 || 394 key_block->keytype == ETYPE_DES_CBC_CRC) { 395 Session_Key skey; 396 397 skey.type = SK_DES; 398 skey.length = 8; 399 skey.data = key_block->keyvalue.data; 400 encrypt_session_key(&skey, 0); 401 } 402 } else { 403 char *msg; 404 405 asprintf(&msg, "user `%s' is not authorized to " 406 "login as `%s'", 407 name ? name : "<unknown>", 408 UserNameRequested ? UserNameRequested : "<nobody>"); 409 if (msg == NULL) 410 Data(ap, KRB_REJECT, NULL, 0); 411 else { 412 Data(ap, KRB_REJECT, (void *) msg, -1); 413 free(msg); 414 } 415 auth_finished(ap, AUTH_REJECT); 416 krb5_free_keyblock_contents(telnet_context, key_block); 417 break; 418 } 419 auth_finished(ap, AUTH_USER); 420 krb5_free_keyblock_contents(telnet_context, key_block); 421 422 break; 423 case KRB_FORWARD:{ 424 struct passwd *pwd; 425 char ccname[1024]; /* XXX */ 426 krb5_data inbuf; 427 krb5_ccache ccache; 428 inbuf.data = (char *) data; 429 inbuf.length = cnt; 430 431 pwd = getpwnam(UserNameRequested); 432 if (pwd == NULL) 433 break; 434 435 snprintf(ccname, sizeof(ccname), 436 "FILE:/tmp/krb5cc_%u", pwd->pw_uid); 437 438 ret = krb5_cc_resolve(telnet_context, ccname, &ccache); 439 if (ret) { 440 if (auth_debug_mode) 441 printf("Kerberos V5: could not get ccache: %s\r\n", 442 krb5_get_err_text(telnet_context, 443 ret)); 444 break; 445 } 446 ret = krb5_cc_initialize(telnet_context, ccache, 447 ticket->client); 448 if (ret) { 449 if (auth_debug_mode) 450 printf("Kerberos V5: could not init ccache: %s\r\n", 451 krb5_get_err_text(telnet_context, 452 ret)); 453 break; 454 } 455 ret = krb5_rd_cred2(telnet_context, auth_context, 456 ccache, &inbuf); 457 if (ret) { 458 char *errbuf; 459 460 asprintf(&errbuf, 461 "Read forwarded creds failed: %s", 462 krb5_get_err_text(telnet_context, ret)); 463 if (errbuf == NULL) 464 Data(ap, KRB_FORWARD_REJECT, NULL, 0); 465 else 466 Data(ap, KRB_FORWARD_REJECT, errbuf, -1); 467 if (auth_debug_mode) 468 printf("Could not read forwarded credentials: %s\r\n", 469 errbuf); 470 free(errbuf); 471 } else 472 Data(ap, KRB_FORWARD_ACCEPT, 0, 0); 473 chown(ccname + 5, pwd->pw_uid, -1); 474 if (auth_debug_mode) 475 printf("Forwarded credentials obtained\r\n"); 476 break; 477 } 478 default: 479 if (auth_debug_mode) 480 printf("Unknown Kerberos option %d\r\n", data[-1]); 481 Data(ap, KRB_REJECT, 0, 0); 482 break; 483 } 484 } 485 486 void 487 kerberos5_reply(Authenticator * ap, unsigned char *data, int cnt) 488 { 489 static int mutual_complete = 0; 490 491 if (cnt-- < 1) 492 return; 493 switch (*data++) { 494 case KRB_REJECT: 495 if (cnt > 0) { 496 printf("[ Kerberos V5 refuses authentication because %.*s ]\r\n", 497 cnt, data); 498 } else 499 printf("[ Kerberos V5 refuses authentication ]\r\n"); 500 auth_send_retry(); 501 return; 502 case KRB_ACCEPT:{ 503 krb5_error_code ret; 504 Session_Key skey; 505 krb5_keyblock *keyblock; 506 507 if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL && 508 !mutual_complete) { 509 printf("[ Kerberos V5 accepted you, but didn't provide mutual authentication! ]\r\n"); 510 auth_send_retry(); 511 return; 512 } 513 if (cnt) 514 printf("[ Kerberos V5 accepts you as ``%.*s'' ]\r\n", cnt, data); 515 else 516 printf("[ Kerberos V5 accepts you ]\r\n"); 517 518 ret = krb5_auth_con_getlocalsubkey(telnet_context, 519 auth_context, &keyblock); 520 if (ret) 521 ret = krb5_auth_con_getkey(telnet_context, 522 auth_context, &keyblock); 523 if (ret) { 524 printf("[ krb5_auth_con_getkey: %s ]\r\n", 525 krb5_get_err_text(telnet_context, ret)); 526 auth_send_retry(); 527 return; 528 } 529 skey.type = SK_DES; 530 skey.length = 8; 531 skey.data = keyblock->keyvalue.data; 532 encrypt_session_key(&skey, 0); 533 krb5_free_keyblock_contents(telnet_context, keyblock); 534 auth_finished(ap, AUTH_USER); 535 if (forward_flags & OPTS_FORWARD_CREDS) 536 kerberos5_forward(ap); 537 break; 538 } 539 case KRB_RESPONSE: 540 if ((ap->way & AUTH_HOW_MASK) == AUTH_HOW_MUTUAL) { 541 /* the rest of the reply should contain a krb_ap_rep */ 542 krb5_ap_rep_enc_part *reply; 543 krb5_data inbuf; 544 krb5_error_code ret; 545 546 inbuf.length = cnt; 547 inbuf.data = (char *) data; 548 549 ret = krb5_rd_rep(telnet_context, 550 auth_context, &inbuf, &reply); 551 if (ret) { 552 printf("[ Mutual authentication failed: %s ]\r\n", 553 krb5_get_err_text(telnet_context, ret)); 554 auth_send_retry(); 555 return; 556 } 557 krb5_free_ap_rep_enc_part(telnet_context, reply); 558 mutual_complete = 1; 559 } 560 return; 561 case KRB_FORWARD_ACCEPT: 562 printf("[ Kerberos V5 accepted forwarded credentials ]\r\n"); 563 return; 564 case KRB_FORWARD_REJECT: 565 printf("[ Kerberos V5 refuses forwarded credentials because %.*s ]\r\n", 566 cnt, data); 567 return; 568 default: 569 if (auth_debug_mode) 570 printf("Unknown Kerberos option %d\r\n", data[-1]); 571 return; 572 } 573 } 574 575 int 576 kerberos5_status(Authenticator *ap, char *name, size_t l, int level) 577 { 578 if (level < AUTH_USER) 579 return (level); 580 581 if (UserNameRequested && 582 krb5_kuserok(telnet_context, ticket->client, UserNameRequested)) { 583 strlcpy(name, UserNameRequested, l); 584 return (AUTH_VALID); 585 } else 586 return (AUTH_USER); 587 } 588 #define BUMP(buf, len) while (*(buf)) {++(buf), --(len);} 589 #define ADDC(buf, len, c) if ((len) > 0) {*(buf)++ = (c); --(len);} 590 591 void 592 kerberos5_printsub(unsigned char *data, int cnt, unsigned char *buf, int buflen) 593 { 594 int i; 595 596 buf[buflen - 1] = '\0'; /* make sure its NULL terminated */ 597 buflen -= 1; 598 599 switch (data[3]) { 600 case KRB_REJECT: /* Rejected (reason might follow) */ 601 strlcpy((char *) buf, " REJECT ", buflen); 602 goto common; 603 604 case KRB_ACCEPT: /* Accepted (name might follow) */ 605 strlcpy((char *) buf, " ACCEPT ", buflen); 606 common: 607 BUMP(buf, buflen); 608 if (cnt <= 4) 609 break; 610 ADDC(buf, buflen, '"'); 611 for (i = 4; i < cnt; i++) 612 ADDC(buf, buflen, data[i]); 613 ADDC(buf, buflen, '"'); 614 ADDC(buf, buflen, '\0'); 615 break; 616 617 618 case KRB_AUTH: /* Authentication data follows */ 619 strlcpy((char *) buf, " AUTH", buflen); 620 goto common2; 621 622 case KRB_RESPONSE: 623 strlcpy((char *) buf, " RESPONSE", buflen); 624 goto common2; 625 626 case KRB_FORWARD: /* Forwarded credentials follow */ 627 strlcpy((char *) buf, " FORWARD", buflen); 628 goto common2; 629 630 case KRB_FORWARD_ACCEPT: /* Forwarded credentials accepted */ 631 strlcpy((char *) buf, " FORWARD_ACCEPT", buflen); 632 goto common2; 633 634 case KRB_FORWARD_REJECT: /* Forwarded credentials rejected */ 635 /* (reason might follow) */ 636 strlcpy((char *) buf, " FORWARD_REJECT", buflen); 637 goto common2; 638 639 default: 640 snprintf(buf, buflen, " %d (unknown)", data[3]); 641 common2: 642 BUMP(buf, buflen); 643 for (i = 4; i < cnt; i++) { 644 snprintf(buf, buflen, " %d", data[i]); 645 BUMP(buf, buflen); 646 } 647 break; 648 } 649 } 650 651 void 652 kerberos5_forward(Authenticator * ap) 653 { 654 krb5_error_code ret; 655 krb5_ccache ccache; 656 krb5_creds creds; 657 krb5_kdc_flags flags; 658 krb5_data out_data; 659 krb5_principal principal; 660 661 ret = krb5_cc_default(telnet_context, &ccache); 662 if (ret) { 663 if (auth_debug_mode) 664 printf("KerberosV5: could not get default ccache: %s\r\n", 665 krb5_get_err_text(telnet_context, ret)); 666 return; 667 } 668 ret = krb5_cc_get_principal(telnet_context, ccache, &principal); 669 if (ret) { 670 if (auth_debug_mode) 671 printf("KerberosV5: could not get principal: %s\r\n", 672 krb5_get_err_text(telnet_context, ret)); 673 return; 674 } 675 memset(&creds, 0, sizeof(creds)); 676 677 creds.client = principal; 678 679 ret = krb5_build_principal(telnet_context, &creds.server, 680 strlen(principal->realm), principal->realm, "krbtgt", 681 principal->realm, NULL); 682 683 if (ret) { 684 if (auth_debug_mode) 685 printf("KerberosV5: could not get principal: %s\r\n", 686 krb5_get_err_text(telnet_context, ret)); 687 return; 688 } 689 creds.times.endtime = 0; 690 691 flags.i = 0; 692 flags.b.forwarded = 1; 693 if (forward_flags & OPTS_FORWARDABLE_CREDS) 694 flags.b.forwardable = 1; 695 696 ret = krb5_get_forwarded_creds(telnet_context, auth_context, 697 ccache, flags.i, RemoteHostName, &creds, &out_data); 698 if (ret) { 699 if (auth_debug_mode) 700 printf("Kerberos V5: error getting forwarded creds: %s\r\n", 701 krb5_get_err_text(telnet_context, ret)); 702 return; 703 } 704 if (!Data(ap, KRB_FORWARD, out_data.data, out_data.length)) { 705 if (auth_debug_mode) 706 printf("Not enough room for authentication data\r\n"); 707 } else { 708 if (auth_debug_mode) 709 printf("Forwarded local Kerberos V5 credentials to server\r\n"); 710 } 711 } 712 #endif /* KRB5 */ 713
Indexes created Thu Sep 25 16:09:42 GMT 2025